From b1aee6b2238794446feba41778f88703784560f7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 16 Mar 2022 17:14:07 +0100 Subject: nft: Reject standard targets as chain names when restoring Reuse parse_chain() called from do_parse() for '-N' and rename it for a better description of what it does. Note that by itself, this patch will likely kill iptables-restore performance for big rulesets due to the extra extension lookup for chain lines. A following patch announcing those chains to libxtables will alleviate that. Signed-off-by: Phil Sutter Reviewed-by: Florian Westphal --- iptables/xshared.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'iptables/xshared.c') diff --git a/iptables/xshared.c b/iptables/xshared.c index 43321d3b..00828c8a 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -1031,7 +1031,7 @@ set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, } } -void parse_chain(const char *chainname) +void assert_valid_chain_name(const char *chainname) { const char *ptr; @@ -1412,7 +1412,7 @@ void do_parse(int argc, char *argv[], break; case 'N': - parse_chain(optarg); + assert_valid_chain_name(optarg); add_command(&p->command, CMD_NEW_CHAIN, CMD_NONE, invert); p->chain = optarg; -- cgit v1.2.3