iptables fixes 20110901

iptables fixes 20110901

[Jan Engelhardt]

The following changes since commit debcf48f6a72914a9c06e99b175ad64ef1f6f1cb:

  libxt_TOS: update linux kernel version list for backported fix (2011-08-26 15:14:04 +0200)

are available in the git repository at:
  git://dev.medozas.de/iptables fixes-2

Jan Engelhardt (1):
      xtoptions: fill in fallback value for nvals

Richard Weinberger (1):
      xtoptions: simplify xtables_parse_interface

Tom Eastep (1):
      libxt_conntrack: improve error message on parsing violation

 extensions/libxt_conntrack.c |   15 +++++++++++----
 iptables/xtables.c           |    4 +---
 iptables/xtoptions.c         |    6 ++++++
 3 files changed, 18 insertions(+), 7 deletions(-)

[PATCH 1/3] xtoptions: fill in fallback value for nvals

[Jan Engelhardt]

Parsing for libxt_conntrack rev 2 is done by using rev 2's option
structure, which specifies XTTYPE_PORT, and using rev 3's parser
skeleton, which uses cb->nvals. Reading cb->nvals when not using
XTTYPE_PORTRC (or any other multi-value type) is undefined behavior.

Make it defined. Since XTTYPE_NONE is the only type that can take
void, nvals logically ought to be 1.

References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
 iptables/xtoptions.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/iptables/xtoptions.c b/iptables/xtoptions.c
index 04344af..5f617a4 100644
--- a/iptables/xtoptions.c
+++ b/iptables/xtoptions.c
@@ -826,6 +826,12 @@ void xtables_option_parse(struct xt_option_call *cb)
 		xt_params->exit_err(PARAMETER_PROBLEM,
 			"%s: option \"--%s\" requires an argument.\n",
 			cb->ext_name, entry->name);
+	/*
+	 * Fill in fallback value for "nvals", in case an extension (as it
+	 * happened with libxt_conntrack.2) tries to read it, despite not using
+	 * a *RC option type.
+	 */
+	cb->nvals = 1;
 	if (entry->type <= ARRAY_SIZE(xtopt_subparse) &&
 	    xtopt_subparse[entry->type] != NULL)
 		xtopt_subparse[entry->type](cb);
-- 
1.7.3.4

[PATCH 2/3] libxt_conntrack: improve error message on parsing violation

[Jan Engelhardt]

From: Tom Eastep <teastep@shorewall.net>

Tom Eastep noted:

$ iptables -A foo -m conntrack --ctorigdstport 22
iptables v1.4.12: conntrack rev 2 does not support port ranges
Try `iptables -h' or 'iptables --help' for more information.

Commit v1.4.12-41-g1ad6407 takes care of the actual cause of the bug,
but let's include Tom's patch nevertheless for the better error
message in case one actually does specify a range with rev 2.

References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
 extensions/libxt_conntrack.c |   15 +++++++++++----
 1 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index 060b947..fff69f8 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -129,13 +129,20 @@ static const struct xt_option_entry conntrack2_mt_opts[] = {
 	 .flags = XTOPT_INVERT},
 	{.name = "ctexpire", .id = O_CTEXPIRE, .type = XTTYPE_UINT32RC,
 	 .flags = XTOPT_INVERT},
-	{.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORT,
+	/*
+	 * Rev 1 and 2 only store one port, and we would normally use
+	 * %XTTYPE_PORT (rather than %XTTYPE_PORTRC) for that. The resulting
+	 * error message - in case a user passed a range nevertheless -
+	 * "port 22:23 resolved to nothing" is not quite as useful as using
+	 * %XTTYPE_PORTC and libxt_conntrack's own range test.
+	 */
+	{.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORTRC,
 	 .flags = XTOPT_INVERT | XTOPT_NBO},
-	{.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORT,
+	{.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORTRC,
 	 .flags = XTOPT_INVERT | XTOPT_NBO},
-	{.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORT,
+	{.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORTRC,
 	 .flags = XTOPT_INVERT | XTOPT_NBO},
-	{.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORT,
+	{.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORTRC,
 	 .flags = XTOPT_INVERT | XTOPT_NBO},
 	{.name = "ctdir", .id = O_CTDIR, .type = XTTYPE_STRING},
 	XTOPT_TABLEEND,
-- 
1.7.3.4

[PATCH 3/3] xtoptions: simplify xtables_parse_interface

[Jan Engelhardt]

From: Richard Weinberger <richard@nod.at>

mask is already filled with zeros, there is no need to zero it again.

References: http://marc.info/?l=netfilter-devel&m=131445196526269&w=2
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
 iptables/xtables.c |    4 +---
 1 files changed, 1 insertions(+), 3 deletions(-)

diff --git a/iptables/xtables.c b/iptables/xtables.c
index 233efa3..e72aa28 100644
--- a/iptables/xtables.c
+++ b/iptables/xtables.c
@@ -515,15 +515,13 @@ void xtables_parse_interface(const char *arg, char *vianame,
 
 	strcpy(vianame, arg);
 	if (vialen == 0)
-		memset(mask, 0, IFNAMSIZ);
+		return;
 	else if (vianame[vialen - 1] == '+') {
 		memset(mask, 0xFF, vialen - 1);
-		memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1);
 		/* Don't remove `+' here! -HW */
 	} else {
 		/* Include nul-terminator in match */
 		memset(mask, 0xFF, vialen + 1);
-		memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1);
 		for (i = 0; vianame[i]; i++) {
 			if (vianame[i] == '/' ||
 			    vianame[i] == ' ') {
-- 
1.7.3.4