* [PATCH iptables v1] iptables-restore/save: exit when given an unknown option
@ 2017-04-03 18:49 Vincent Bernat
2017-04-13 21:16 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: Vincent Bernat @ 2017-04-03 18:49 UTC (permalink / raw)
To: netfilter-devel, Pablo Neira Ayuso; +Cc: Vincent Bernat
When an unknown option is given, iptables-restore should exit instead of
continue its operation. For example, if `--table` was misspelled, this
could lead to an unwanted change. Moreover, exit with a status code of
1. Make the same change for iptables-save.
OTOH, exit with a status code of 0 when requesting help.
Signed-off-by: Vincent Bernat <vincent@bernat.im>
---
iptables/ip6tables-restore.c | 10 +++++-----
iptables/ip6tables-save.c | 4 ++++
iptables/iptables-restore.c | 10 +++++-----
iptables/iptables-save.c | 4 ++++
4 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/iptables/ip6tables-restore.c b/iptables/ip6tables-restore.c
index 8a47f09c9503..b12d7f7f22bd 100644
--- a/iptables/ip6tables-restore.c
+++ b/iptables/ip6tables-restore.c
@@ -46,8 +46,6 @@ static const struct option options[] = {
{NULL},
};
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
static void print_usage(const char *name, const char *version)
{
fprintf(stderr, "Usage: %s [-c] [-v] [-t] [-h] [-n] [-w secs] [-W usecs] [-T table] [-M command]\n"
@@ -60,8 +58,6 @@ static void print_usage(const char *name, const char *version)
" [ --wait-interval=<usecs>\n"
" [ --table=<TABLE> ]\n"
" [ --modprobe=<command> ]\n", name);
-
- exit(1);
}
static struct xtc_handle *create_handle(const char *tablename)
@@ -230,7 +226,7 @@ int ip6tables_restore_main(int argc, char *argv[])
case 'h':
print_usage("ip6tables-restore",
IPTABLES_VERSION);
- break;
+ exit(0);
case 'n':
noflush = 1;
break;
@@ -246,6 +242,10 @@ int ip6tables_restore_main(int argc, char *argv[])
case 'T':
tablename = optarg;
break;
+ default:
+ fprintf(stderr,
+ "Try `ip6tables-restore -h' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/ip6tables-save.c b/iptables/ip6tables-save.c
index 053413a9dfe2..a6006146e460 100644
--- a/iptables/ip6tables-save.c
+++ b/iptables/ip6tables-save.c
@@ -162,6 +162,10 @@ int ip6tables_save_main(int argc, char *argv[])
case 'd':
do_output(tablename);
exit(0);
+ default:
+ fprintf(stderr,
+ "Look at manual page `ip6tables-save.8' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
index 7bb06d84b1bf..246ade05b30d 100644
--- a/iptables/iptables-restore.c
+++ b/iptables/iptables-restore.c
@@ -43,8 +43,6 @@ static const struct option options[] = {
{NULL},
};
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
#define prog_name iptables_globals.program_name
static void print_usage(const char *name, const char *version)
@@ -59,8 +57,6 @@ static void print_usage(const char *name, const char *version)
" [ --wait-interval=<usecs>\n"
" [ --table=<TABLE> ]\n"
" [ --modprobe=<command> ]\n", name);
-
- exit(1);
}
static struct xtc_handle *create_handle(const char *tablename)
@@ -229,7 +225,7 @@ iptables_restore_main(int argc, char *argv[])
case 'h':
print_usage("iptables-restore",
IPTABLES_VERSION);
- break;
+ exit(0);
case 'n':
noflush = 1;
break;
@@ -245,6 +241,10 @@ iptables_restore_main(int argc, char *argv[])
case 'T':
tablename = optarg;
break;
+ default:
+ fprintf(stderr,
+ "Try `iptables-restore -h' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/iptables-save.c b/iptables/iptables-save.c
index e8ae9c6c4cc9..d2c1ca9ecb2b 100644
--- a/iptables/iptables-save.c
+++ b/iptables/iptables-save.c
@@ -161,6 +161,10 @@ iptables_save_main(int argc, char *argv[])
case 'd':
do_output(tablename);
exit(0);
+ default:
+ fprintf(stderr,
+ "Look at manual page `iptables-save.8' for more information.\n");
+ exit(1);
}
}
--
2.11.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH iptables v1] iptables-restore/save: exit when given an unknown option
2017-04-03 18:49 [PATCH iptables v1] iptables-restore/save: exit when given an unknown option Vincent Bernat
@ 2017-04-13 21:16 ` Pablo Neira Ayuso
2017-04-14 11:56 ` [PATCH iptables v2] " Vincent Bernat
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2017-04-13 21:16 UTC (permalink / raw)
To: Vincent Bernat; +Cc: netfilter-devel
On Mon, Apr 03, 2017 at 08:49:18PM +0200, Vincent Bernat wrote:
> When an unknown option is given, iptables-restore should exit instead of
> continue its operation. For example, if `--table` was misspelled, this
> could lead to an unwanted change. Moreover, exit with a status code of
> 1. Make the same change for iptables-save.
I was trying to skip this, since this has been working like this since
day 1 and some stupid script may break, but OK, let's fix this.
> OTOH, exit with a status code of 0 when requesting help.
Could you also fix xtables-restore.c that is used for the compat
layer?
Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH iptables v2] iptables-restore/save: exit when given an unknown option
2017-04-13 21:16 ` Pablo Neira Ayuso
@ 2017-04-14 11:56 ` Vincent Bernat
2017-04-15 8:50 ` Pablo Neira Ayuso
2017-04-15 10:16 ` [PATCH iptables v3] " Vincent Bernat
0 siblings, 2 replies; 6+ messages in thread
From: Vincent Bernat @ 2017-04-14 11:56 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: Vincent Bernat
When an unknown option is given, iptables-restore should exit instead of
continue its operation. For example, if `--table` was misspelled, this
could lead to an unwanted change. Moreover, exit with a status code of
1. Make the same change for iptables-save.
OTOH, exit with a status code of 0 when requesting help.
Signed-off-by: Vincent Bernat <vincent@bernat.im>
---
iptables/ip6tables-restore.c | 10 +++++-----
iptables/ip6tables-save.c | 4 ++++
iptables/iptables-restore.c | 10 +++++-----
iptables/iptables-save.c | 4 ++++
iptables/xtables-restore.c | 10 +++++-----
iptables/xtables-save.c | 4 ++++
6 files changed, 27 insertions(+), 15 deletions(-)
diff --git a/iptables/ip6tables-restore.c b/iptables/ip6tables-restore.c
index 8a47f09c9503..b12d7f7f22bd 100644
--- a/iptables/ip6tables-restore.c
+++ b/iptables/ip6tables-restore.c
@@ -46,8 +46,6 @@ static const struct option options[] = {
{NULL},
};
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
static void print_usage(const char *name, const char *version)
{
fprintf(stderr, "Usage: %s [-c] [-v] [-t] [-h] [-n] [-w secs] [-W usecs] [-T table] [-M command]\n"
@@ -60,8 +58,6 @@ static void print_usage(const char *name, const char *version)
" [ --wait-interval=<usecs>\n"
" [ --table=<TABLE> ]\n"
" [ --modprobe=<command> ]\n", name);
-
- exit(1);
}
static struct xtc_handle *create_handle(const char *tablename)
@@ -230,7 +226,7 @@ int ip6tables_restore_main(int argc, char *argv[])
case 'h':
print_usage("ip6tables-restore",
IPTABLES_VERSION);
- break;
+ exit(0);
case 'n':
noflush = 1;
break;
@@ -246,6 +242,10 @@ int ip6tables_restore_main(int argc, char *argv[])
case 'T':
tablename = optarg;
break;
+ default:
+ fprintf(stderr,
+ "Try `ip6tables-restore -h' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/ip6tables-save.c b/iptables/ip6tables-save.c
index 053413a9dfe2..a6006146e460 100644
--- a/iptables/ip6tables-save.c
+++ b/iptables/ip6tables-save.c
@@ -162,6 +162,10 @@ int ip6tables_save_main(int argc, char *argv[])
case 'd':
do_output(tablename);
exit(0);
+ default:
+ fprintf(stderr,
+ "Look at manual page `ip6tables-save.8' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
index 7bb06d84b1bf..246ade05b30d 100644
--- a/iptables/iptables-restore.c
+++ b/iptables/iptables-restore.c
@@ -43,8 +43,6 @@ static const struct option options[] = {
{NULL},
};
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
#define prog_name iptables_globals.program_name
static void print_usage(const char *name, const char *version)
@@ -59,8 +57,6 @@ static void print_usage(const char *name, const char *version)
" [ --wait-interval=<usecs>\n"
" [ --table=<TABLE> ]\n"
" [ --modprobe=<command> ]\n", name);
-
- exit(1);
}
static struct xtc_handle *create_handle(const char *tablename)
@@ -229,7 +225,7 @@ iptables_restore_main(int argc, char *argv[])
case 'h':
print_usage("iptables-restore",
IPTABLES_VERSION);
- break;
+ exit(0);
case 'n':
noflush = 1;
break;
@@ -245,6 +241,10 @@ iptables_restore_main(int argc, char *argv[])
case 'T':
tablename = optarg;
break;
+ default:
+ fprintf(stderr,
+ "Try `iptables-restore -h' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/iptables-save.c b/iptables/iptables-save.c
index e8ae9c6c4cc9..d2c1ca9ecb2b 100644
--- a/iptables/iptables-save.c
+++ b/iptables/iptables-save.c
@@ -161,6 +161,10 @@ iptables_save_main(int argc, char *argv[])
case 'd':
do_output(tablename);
exit(0);
+ default:
+ fprintf(stderr,
+ "Look at manual page `iptables-save.8' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index a551c8c19f7f..f018e6f454d5 100644
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -40,8 +40,6 @@ static const struct option options[] = {
{NULL},
};
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
#define prog_name xtables_globals.program_name
static void print_usage(const char *name, const char *version)
@@ -56,8 +54,6 @@ static void print_usage(const char *name, const char *version)
" [ --modprobe=<command> ]\n"
" [ --ipv4 ]\n"
" [ --ipv6 ]\n", name);
-
- exit(1);
}
static int parse_counters(char *string, struct xt_counters *ctr)
@@ -486,7 +482,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
case 'h':
print_usage("xtables-restore",
IPTABLES_VERSION);
- break;
+ exit(0);
case 'n':
noflush = 1;
break;
@@ -503,6 +499,10 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
h.family = AF_INET6;
xtables_set_nfproto(AF_INET6);
break;
+ default:
+ fprintf(stderr,
+ "Try `xtables-restore -h' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
index f30867cf62bb..abd840af6607 100644
--- a/iptables/xtables-save.c
+++ b/iptables/xtables-save.c
@@ -130,6 +130,10 @@ xtables_save_main(int family, const char *progname, int argc, char *argv[])
h.family = AF_INET6;
xtables_set_nfproto(AF_INET6);
break;
+ default:
+ fprintf(stderr,
+ "Look at manual page `xtables-save.8' for more information.\n");
+ exit(1);
}
}
--
2.11.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH iptables v2] iptables-restore/save: exit when given an unknown option
2017-04-14 11:56 ` [PATCH iptables v2] " Vincent Bernat
@ 2017-04-15 8:50 ` Pablo Neira Ayuso
2017-04-15 10:16 ` [PATCH iptables v3] " Vincent Bernat
1 sibling, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2017-04-15 8:50 UTC (permalink / raw)
To: Vincent Bernat; +Cc: netfilter-devel
On Fri, Apr 14, 2017 at 01:56:21PM +0200, Vincent Bernat wrote:
> When an unknown option is given, iptables-restore should exit instead of
> continue its operation. For example, if `--table` was misspelled, this
> could lead to an unwanted change. Moreover, exit with a status code of
> 1. Make the same change for iptables-save.
>
> OTOH, exit with a status code of 0 when requesting help.
Hm, this doesn't apply cleanly to iptables.git for some reason.
$ git am /var/tmp/iptables-v2-iptables-restore-save-exit-when-given-an-unknown-option.patch
Applying: iptables-restore/save: exit when given an unknown option
error: patch failed: iptables/ip6tables-restore.c:46
error: iptables/ip6tables-restore.c: patch does not apply
error: patch failed: iptables/iptables-restore.c:43
error: iptables/iptables-restore.c: patch does not apply
Patch failed at 0001 iptables-restore/save: exit when given an unknown option
The copy of the patch that failed is found in:
/home/devel/iptables/.git/rebase-apply/patch
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".
Would you refresh your tree and resubmit? Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH iptables v3] iptables-restore/save: exit when given an unknown option
2017-04-14 11:56 ` [PATCH iptables v2] " Vincent Bernat
2017-04-15 8:50 ` Pablo Neira Ayuso
@ 2017-04-15 10:16 ` Vincent Bernat
2017-04-19 16:00 ` Pablo Neira Ayuso
1 sibling, 1 reply; 6+ messages in thread
From: Vincent Bernat @ 2017-04-15 10:16 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: Vincent Bernat
When an unknown option is given, iptables-restore should exit instead of
continue its operation. For example, if `--table` was misspelled, this
could lead to an unwanted change. Moreover, exit with a status code of
1. Make the same change for iptables-save.
OTOH, exit with a status code of 0 when requesting help.
Signed-off-by: Vincent Bernat <vincent@bernat.im>
---
iptables/ip6tables-restore.c | 10 +++++-----
iptables/ip6tables-save.c | 4 ++++
iptables/iptables-restore.c | 10 +++++-----
iptables/iptables-save.c | 4 ++++
iptables/xtables-restore.c | 10 +++++-----
iptables/xtables-save.c | 4 ++++
6 files changed, 27 insertions(+), 15 deletions(-)
diff --git a/iptables/ip6tables-restore.c b/iptables/ip6tables-restore.c
index 419a2b0e89cc..39a881dfcee0 100644
--- a/iptables/ip6tables-restore.c
+++ b/iptables/ip6tables-restore.c
@@ -47,8 +47,6 @@ static const struct option options[] = {
{NULL},
};
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
#define prog_name ip6tables_globals.program_name
#define prog_vers ip6tables_globals.program_version
@@ -65,8 +63,6 @@ static void print_usage(const char *name, const char *version)
" [ --wait-interval=<usecs>\n"
" [ --table=<TABLE> ]\n"
" [ --modprobe=<command> ]\n", name);
-
- exit(1);
}
static struct xtc_handle *create_handle(const char *tablename)
@@ -237,7 +233,7 @@ int ip6tables_restore_main(int argc, char *argv[])
case 'h':
print_usage("ip6tables-restore",
IPTABLES_VERSION);
- break;
+ exit(0);
case 'n':
noflush = 1;
break;
@@ -253,6 +249,10 @@ int ip6tables_restore_main(int argc, char *argv[])
case 'T':
tablename = optarg;
break;
+ default:
+ fprintf(stderr,
+ "Try `ip6tables-restore -h' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/ip6tables-save.c b/iptables/ip6tables-save.c
index c2495d20feb9..250ca20492b6 100644
--- a/iptables/ip6tables-save.c
+++ b/iptables/ip6tables-save.c
@@ -162,6 +162,10 @@ int ip6tables_save_main(int argc, char *argv[])
case 'd':
do_output(tablename);
exit(0);
+ default:
+ fprintf(stderr,
+ "Look at manual page `ip6tables-save.8' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
index cb06559b1906..876fe06d7fa6 100644
--- a/iptables/iptables-restore.c
+++ b/iptables/iptables-restore.c
@@ -44,8 +44,6 @@ static const struct option options[] = {
{NULL},
};
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
#define prog_name iptables_globals.program_name
#define prog_vers iptables_globals.program_version
@@ -62,8 +60,6 @@ static void print_usage(const char *name, const char *version)
" [ --wait-interval=<usecs>\n"
" [ --table=<TABLE> ]\n"
" [ --modprobe=<command> ]\n", name);
-
- exit(1);
}
static struct xtc_handle *create_handle(const char *tablename)
@@ -235,7 +231,7 @@ iptables_restore_main(int argc, char *argv[])
case 'h':
print_usage("iptables-restore",
IPTABLES_VERSION);
- break;
+ exit(0);
case 'n':
noflush = 1;
break;
@@ -251,6 +247,10 @@ iptables_restore_main(int argc, char *argv[])
case 'T':
tablename = optarg;
break;
+ default:
+ fprintf(stderr,
+ "Try `iptables-restore -h' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/iptables-save.c b/iptables/iptables-save.c
index fbc605932c09..52929b0996e9 100644
--- a/iptables/iptables-save.c
+++ b/iptables/iptables-save.c
@@ -161,6 +161,10 @@ iptables_save_main(int argc, char *argv[])
case 'd':
do_output(tablename);
exit(0);
+ default:
+ fprintf(stderr,
+ "Look at manual page `iptables-save.8' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index 6afa0d0ec5b1..15824f0f40b5 100644
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -40,8 +40,6 @@ static const struct option options[] = {
{NULL},
};
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
#define prog_name xtables_globals.program_name
static void print_usage(const char *name, const char *version)
@@ -56,8 +54,6 @@ static void print_usage(const char *name, const char *version)
" [ --modprobe=<command> ]\n"
" [ --ipv4 ]\n"
" [ --ipv6 ]\n", name);
-
- exit(1);
}
static int parse_counters(char *string, struct xt_counters *ctr)
@@ -486,7 +482,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
case 'h':
print_usage("xtables-restore",
IPTABLES_VERSION);
- break;
+ exit(0);
case 'n':
noflush = 1;
break;
@@ -503,6 +499,10 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
h.family = AF_INET6;
xtables_set_nfproto(AF_INET6);
break;
+ default:
+ fprintf(stderr,
+ "Try `xtables-restore -h' for more information.\n");
+ exit(1);
}
}
diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
index f30867cf62bb..abd840af6607 100644
--- a/iptables/xtables-save.c
+++ b/iptables/xtables-save.c
@@ -130,6 +130,10 @@ xtables_save_main(int family, const char *progname, int argc, char *argv[])
h.family = AF_INET6;
xtables_set_nfproto(AF_INET6);
break;
+ default:
+ fprintf(stderr,
+ "Look at manual page `xtables-save.8' for more information.\n");
+ exit(1);
}
}
--
2.11.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH iptables v3] iptables-restore/save: exit when given an unknown option
2017-04-15 10:16 ` [PATCH iptables v3] " Vincent Bernat
@ 2017-04-19 16:00 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2017-04-19 16:00 UTC (permalink / raw)
To: Vincent Bernat; +Cc: netfilter-devel
On Sat, Apr 15, 2017 at 12:16:47PM +0200, Vincent Bernat wrote:
> When an unknown option is given, iptables-restore should exit instead of
> continue its operation. For example, if `--table` was misspelled, this
> could lead to an unwanted change. Moreover, exit with a status code of
> 1. Make the same change for iptables-save.
>
> OTOH, exit with a status code of 0 when requesting help.
Applied, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-04-19 16:01 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-04-03 18:49 [PATCH iptables v1] iptables-restore/save: exit when given an unknown option Vincent Bernat
2017-04-13 21:16 ` Pablo Neira Ayuso
2017-04-14 11:56 ` [PATCH iptables v2] " Vincent Bernat
2017-04-15 8:50 ` Pablo Neira Ayuso
2017-04-15 10:16 ` [PATCH iptables v3] " Vincent Bernat
2017-04-19 16:00 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.