From fdb2a27825e558393fb715374c07873830d4d149 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sat, 27 Aug 2011 17:59:52 +0200 Subject: xtoptions: fill in fallback value for nvals Parsing for libxt_conntrack rev 2 is done by using rev 2's option structure, which specifies XTTYPE_PORT, and using rev 3's parser skeleton, which uses cb->nvals. Reading cb->nvals when not using XTTYPE_PORTRC (or any other multi-value type) is undefined behavior. Make it defined. Since XTTYPE_NONE is the only type that can take void, nvals logically ought to be 1. References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2 Signed-off-by: Jan Engelhardt --- iptables/xtoptions.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/iptables/xtoptions.c b/iptables/xtoptions.c index 04344af4..5f617a42 100644 --- a/iptables/xtoptions.c +++ b/iptables/xtoptions.c @@ -826,6 +826,12 @@ void xtables_option_parse(struct xt_option_call *cb) xt_params->exit_err(PARAMETER_PROBLEM, "%s: option \"--%s\" requires an argument.\n", cb->ext_name, entry->name); + /* + * Fill in fallback value for "nvals", in case an extension (as it + * happened with libxt_conntrack.2) tries to read it, despite not using + * a *RC option type. + */ + cb->nvals = 1; if (entry->type <= ARRAY_SIZE(xtopt_subparse) && xtopt_subparse[entry->type] != NULL) xtopt_subparse[entry->type](cb); -- cgit v1.2.3 From 3412bd0bfb8b8bac9834cbfd3392b3d5487133bf Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Thu, 18 Aug 2011 15:11:16 -0700 Subject: libxt_conntrack: improve error message on parsing violation Tom Eastep noted: $ iptables -A foo -m conntrack --ctorigdstport 22 iptables v1.4.12: conntrack rev 2 does not support port ranges Try `iptables -h' or 'iptables --help' for more information. Commit v1.4.12-41-g1ad6407 takes care of the actual cause of the bug, but let's include Tom's patch nevertheless for the better error message in case one actually does specify a range with rev 2. References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2 Signed-off-by: Jan Engelhardt --- extensions/libxt_conntrack.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c index 060b9477..fff69f8a 100644 --- a/extensions/libxt_conntrack.c +++ b/extensions/libxt_conntrack.c @@ -129,13 +129,20 @@ static const struct xt_option_entry conntrack2_mt_opts[] = { .flags = XTOPT_INVERT}, {.name = "ctexpire", .id = O_CTEXPIRE, .type = XTTYPE_UINT32RC, .flags = XTOPT_INVERT}, - {.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORT, + /* + * Rev 1 and 2 only store one port, and we would normally use + * %XTTYPE_PORT (rather than %XTTYPE_PORTRC) for that. The resulting + * error message - in case a user passed a range nevertheless - + * "port 22:23 resolved to nothing" is not quite as useful as using + * %XTTYPE_PORTC and libxt_conntrack's own range test. + */ + {.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORTRC, .flags = XTOPT_INVERT | XTOPT_NBO}, - {.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORT, + {.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORTRC, .flags = XTOPT_INVERT | XTOPT_NBO}, - {.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORT, + {.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORTRC, .flags = XTOPT_INVERT | XTOPT_NBO}, - {.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORT, + {.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORTRC, .flags = XTOPT_INVERT | XTOPT_NBO}, {.name = "ctdir", .id = O_CTDIR, .type = XTTYPE_STRING}, XTOPT_TABLEEND, -- cgit v1.2.3 From 2ca6273c73b42e8c74afd5f8b1fe10c5c93ce363 Mon Sep 17 00:00:00 2001 From: Richard Weinberger Date: Sat, 27 Aug 2011 15:32:31 +0200 Subject: xtoptions: simplify xtables_parse_interface mask is already filled with zeros, there is no need to zero it again. References: http://marc.info/?l=netfilter-devel&m=131445196526269&w=2 Signed-off-by: Jan Engelhardt --- iptables/xtables.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/iptables/xtables.c b/iptables/xtables.c index 233efa30..e72aa284 100644 --- a/iptables/xtables.c +++ b/iptables/xtables.c @@ -515,15 +515,13 @@ void xtables_parse_interface(const char *arg, char *vianame, strcpy(vianame, arg); if (vialen == 0) - memset(mask, 0, IFNAMSIZ); + return; else if (vianame[vialen - 1] == '+') { memset(mask, 0xFF, vialen - 1); - memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1); /* Don't remove `+' here! -HW */ } else { /* Include nul-terminator in match */ memset(mask, 0xFF, vialen + 1); - memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1); for (i = 0; vianame[i]; i++) { if (vianame[i] == '/' || vianame[i] == ' ') { -- cgit v1.2.3