summaryrefslogtreecommitdiffstats
path: root/libxtables/xtoptions.c
Commit message (Collapse)AuthorAgeFilesLines
* libxtables: xtoptions: Respect min/max values when completing rangesPhil Sutter2024-02-021-3/+6
| | | | | | | | If an extension defines a minimum/maximum valid value for an option's range argument, treat this as the lower/upper boundary to use when completing (half) open ranges. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Reject negative port rangesPhil Sutter2024-02-021-1/+6
| | | | | | | Analogous to XTTYPE_UINT*RC value parsing, assert consecutive port values are not lower than previous ones. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Assert ranges are monotonic increasingPhil Sutter2024-02-021-4/+5
| | | | | | | | | | | Extensions commonly require the upper range value to be larger or equal to the lower one. Performing this check in the parser is easier and covers all extensions at once. One notable exception is NFQUEUE which requires strict monotonicity. Hence leave its checks in place. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Treat NFPROTO_BRIDGE as IPv4Phil Sutter2024-01-101-0/+1
| | | | | | | | | When parsing for XTTYPE_HOST(MASK), the return value of afinfo_family() is used to indicate the expected address family. Make guided option parser expect IPv4 by default for ebtables as this is the more common case. The exception is libebt_ip6, which will temporarily adjust afinfo->family while parsing.
* libxtables: xtoptions: Implement XTTYPE_ETHERMACMASKPhil Sutter2024-01-101-0/+10
| | | | | | Accept an Ethernet MAC address with optional mask in the format xtables_parse_mac_and_mask() expects it. Does not support XTOPT_PUT (for now) due to the lack of defined data structure.
* libxtables: xtoptions: Support XTOPT_NBO with XTTYPE_UINT*Phil Sutter2024-01-101-9/+31
| | | | | Value conversion into Big Endian byteorder is pretty straightforward, merely needed a small helper for uint64.
* libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASKPhil Sutter2024-01-101-1/+0
| | | | | | | | Do as the comment in xtopt_parse_hostmask() claims and omit XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() will catch the incompatibility. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
* libxtables: xtoptions: Fix for non-CIDR-compatible hostmasksPhil Sutter2023-11-291-0/+5
| | | | | | | | | | | | | | | | | | | In order to parse the mask, xtopt_parse_hostmask() calls xtopt_parse_plenmask() thereby limiting netmask support to prefix lengths (alternatively specified in IP address notation). In order to lift this impractical restriction, make xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may fall back to xtopt_parse_mask() which correctly initializes val.hmask itself and indicates non-CIDR-compatible masks by setting val.hlen to -1. So in order to support these odd masks, it is sufficient for xtopt_parse_plenmask() to skip its mask building from val.hlen value and take whatever val.hmask contains. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: xtoptions: Fix for garbage access in xtables_options_xfrm()Phil Sutter2023-11-291-1/+2
| | | | | | | | | | Allocation of the temporary array did not account for a terminating NULL entry, causing array boundary overstepping in the called xtables_merge_options(), causing spurious errors in extension parameter parsing. Fixes: ed8c3ea4015f0 ("libxtables: Combine the two extension option mergers") Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce struct xt_option_entry::basePhil Sutter2023-11-231-1/+2
| | | | | | | Enable guided option parser users to parse integer values with a fixed base. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix guided option parser for use with arptablesPhil Sutter2023-11-231-5/+18
| | | | | | | | With an unexpected value in afinfo->family, guided option parser was rather useless when called from arptables extensions. Introduce afinfo_family() wrapper to sanitize at least NFPROTO_ARP value. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Combine the two extension option mergersPhil Sutter2023-11-231-43/+8
| | | | | | | | | | For extending the command parser's struct option array, there is xtables_merge_options() and xtables_options_xfrm(). Since their bodies were almost identical, make the latter a wrapper of the former by transforming the passed struct xt_option_entry array into a temporary struct option one before handing over. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Drop extra newline from xtables_error() callsPhil Sutter2022-11-151-2/+2
| | | | | | | | | | Since basic_exit_err() appends a newline to the message itself, drop explicit ones. While being at it, fix indentation and join texts split over multiple lines. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.hPhil Sutter2022-06-231-1/+0
| | | | | | | | This is the last symbol in xshared.h used by libxtables, move it over. Again, treat this as "implementation detail" and hence put it behind XTABLES_INTERNAL-curtains. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Introduce xtables_strdup() and use it everywherePhil Sutter2021-06-071-11/+3
| | | | | | This wraps strdup(), checking for errors. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Fix memleak in xtopt_parse_hostmask()Phil Sutter2021-06-071-0/+1
| | | | | | | The allocated hostmask duplicate needs to be freed again. Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Fix a few cases of pointless assignmentsPhil Sutter2018-09-241-1/+1
| | | | | | | | This gets rid of a number of assignments which are either redundant or not used afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: Avoid calling memcpy() with NULL sourcePhil Sutter2018-09-241-4/+8
| | | | | | | | | | Both affected functions check if 'oldopts' is NULL once but later seem to ignore that possibility. To catch up on that, increment the pointer only if it isn't NULL, also don't copy its content into the merged options buffer in that case. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: Fix potential array overrun in xtables_option_parse()Phil Sutter2018-09-131-1/+1
| | | | | | | | If entry->type is to be used as array index, it needs to be at max one less than that array's size. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Introduce and use common function to parse val[/mask] argumentsSerhey Popovych2018-04-271-21/+1
| | | | | | | | | | | | | | There are a couple of places in both core and extensions where arguments in the form of val[/mask] is parsed (see XTTYPE_MARKMASK32). In some cases symbolic name might be used which is mapped in code to numeric value. Introduce common function to handle both cases where value given is either val[/mask] or symbolic name. Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* libxtables: fix getaddrinfo return value usageDomen Puncer2014-06-131-3/+3
| | | | | | | | | | | | | | getaddrinfo return value on error can also be positive. On Android they're positive, e.g.: android-ndk-r9d/platforms/android-19/arch-arm/usr/include/netdb.h 147 #define EAI_NONAME 8 /* hostname nor servname provided, or not known */ And as a plus, it's not bad to conform to specs. Signed-off-by: Domen Puncer Kugler <domen.puncer@samsung.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Print meaningful error message for an invalid MAC address stringMart Frauenlob2014-02-021-1/+1
| | | | | | | | If an invalid MAC address is used on the commmand line, the error message `ether' was not really describing the problem. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: fix parsing of dotted network mask formatPablo Neira Ayuso2013-05-091-3/+35
| | | | | | | | | | | | | | After upgrade from iptables 1.4.8 to 1.4.18 netmask parsing got broken: -A foo -m policy --mode tunnel --dir in --tunnel-src 192.168.123.0/255.255.255.0 -j RETURN With iptables 1.4.18: iptables-restore v1.4.18: policy: bad value for option "--tunnel-src", or out of range (0-32) This was probably broken by the augmented parser. Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libxtables: Fix file descriptor leak in xtables_lmap_init on errorThomas Jarosch2011-09-281-0/+1
| | | | | Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: restore build order of modulesJan Engelhardt2011-09-191-0/+1171
iptables(exe) requires libext.a, but extensions/ require libxtables.la (in iptables/). This circular dependency does not work out, so separate libxtables into its own directory and put it in front. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>