All of lore.kernel.org
 help / color / mirror / Atom feed
* [ebtables-compat PATCH] ebtables-compat: fix segfault in rules w/o target
@ 2014-12-30 15:44 Arturo Borrero Gonzalez
  2015-01-05 13:05 ` Pablo Neira Ayuso
  0 siblings, 1 reply; 2+ messages in thread
From: Arturo Borrero Gonzalez @ 2014-12-30 15:44 UTC (permalink / raw)
  To: netfilter-devel; +Cc: giuseppelng, pablo

This patch fixes a segfault in rules without target.

Now, these two rules are allowed:

% ebtables-compat -A FORWARD -p 0x0600 -j CONTINUE
% ebtables-compat -A FORWARD -p 0x0600

And both are printed:

Bridge chain: FORWARD, entries: 1, policy: ACCEPT
-p 0x600 -j CONTINUE

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
 iptables/nft-bridge.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
index 90bcd63..79abf73 100644
--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
@@ -114,6 +114,12 @@ static int _add_action(struct nft_rule *r, struct ebtables_command_state *cs)
 {
 	int ret = 0;
 
+	if (cs->jumpto == NULL)
+		return 0;
+
+	if (strcmp(cs->jumpto, "CONTINUE") == 0)
+		return 0;
+
 	/* If no target at all, add nothing (default to continue) */
 	if (cs->target != NULL) {
 		/* Standard target? */
@@ -462,6 +468,10 @@ static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
 		}
 	}
 
+	if (strcmp(cs.jumpto, "") == 0) {
+		printf("CONTINUE");
+	}
+
 	if (!(format & FMT_NOCOUNTS))
 		printf(" , pcnt = %"PRIu64" -- bcnt = %"PRIu64"",
 		       (uint64_t)cs.counters.pcnt, (uint64_t)cs.counters.bcnt);


^ permalink raw reply related	[flat|nested] 2+ messages in thread
* Re: [ebtables-compat PATCH] ebtables-compat: fix segfault in rules w/o target
  2014-12-30 15:44 [ebtables-compat PATCH] ebtables-compat: fix segfault in rules w/o target Arturo Borrero Gonzalez
@ 2015-01-05 13:05 ` Pablo Neira Ayuso
  0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2015-01-05 13:05 UTC (permalink / raw)
  To: Arturo Borrero Gonzalez; +Cc: netfilter-devel, giuseppelng

On Tue, Dec 30, 2014 at 04:44:44PM +0100, Arturo Borrero Gonzalez wrote:
> This patch fixes a segfault in rules without target.
> 
> Now, these two rules are allowed:
> 
> % ebtables-compat -A FORWARD -p 0x0600 -j CONTINUE
> % ebtables-compat -A FORWARD -p 0x0600
> 
> And both are printed:
> 
> Bridge chain: FORWARD, entries: 1, policy: ACCEPT
> -p 0x600 -j CONTINUE
> 
> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
> ---
>  iptables/nft-bridge.c |   10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
> index 90bcd63..79abf73 100644
> --- a/iptables/nft-bridge.c
> +++ b/iptables/nft-bridge.c
> @@ -114,6 +114,12 @@ static int _add_action(struct nft_rule *r, struct ebtables_command_state *cs)
>  {
>  	int ret = 0;
>  
> +	if (cs->jumpto == NULL)
> +		return 0;
> +
> +	if (strcmp(cs->jumpto, "CONTINUE") == 0)
> +		return 0;

Could you consolidate this code?

        if (cs->jumpto == NULL || strcmp(...) == 0)
                return 0;

> +
>  	/* If no target at all, add nothing (default to continue) */
>  	if (cs->target != NULL) {
>  		/* Standard target? */
> @@ -462,6 +468,10 @@ static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
>  		}
>  	}
>  
> +	if (strcmp(cs.jumpto, "") == 0) {
> +		printf("CONTINUE");
> +	}

You can remove the brackets, and...

        printf("-j ");
        if (!(format & FMT_NOTARGET))
                printf("%s", cs.jumpto); <----- is this handling this case?

        if (cs.target != NULL) {
                if (cs.target->print != NULL) {
                        cs.target->print(&cs.fw, cs.target->t,
                                            format & FMT_NUMERIC);
                }
        }

        if (strcmp(cs.jumpto, "") == 0)
                printf("CONTINUE");


^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-01-05 13:03 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-12-30 15:44 [ebtables-compat PATCH] ebtables-compat: fix segfault in rules w/o target Arturo Borrero Gonzalez
2015-01-05 13:05 ` Pablo Neira Ayuso

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.