ebtables-compat: fix segfault in rules w/o target

PATCH Superseded Arturo Borrero Gonzalez 2 participants 2 messages Dec 30, 2014 – Jan 5, 2015 netfilter

lore

Share & tools

lore

Arturo Borrero Gonzalez

author

2014-12-30 15:44 UTC #0 lore raw

PATCH 1/1 ebtables-compat: fix segfault in rules w/o target

This patch fixes a segfault in rules without target.

Now, these two rules are allowed:

% ebtables-compat -A FORWARD -p 0x0600 -j CONTINUE % ebtables-compat -A FORWARD -p 0x0600

And both are printed:

Bridge chain: FORWARD, entries: 1, policy: ACCEPT
-p 0x600 -j CONTINUE

Signed-off-by Arturo Borrero Gonzalez <[email protected]>

---
 iptables/nft-bridge.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

iptables/nft-bridge.c +10 -0

index 90bcd63..79abf73 100644
@@ -114,6 +114,12 @@ static int _add_action(struct nft_rule *r, struct ebtables_command_state *cs)
 {
 	int ret = 0;
 
+	if (cs->jumpto == NULL)
+		return 0;
+
+	if (strcmp(cs->jumpto, "CONTINUE") == 0)
+		return 0;
+
 	/* If no target at all, add nothing (default to continue) */
 	if (cs->target != NULL) {
 		/* Standard target? */

@@ -462,6 +468,10 @@ static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
 		}
 	}
 
+	if (strcmp(cs.jumpto, "") == 0) {
+		printf("CONTINUE");
+	}
+
 	if (!(format & FMT_NOCOUNTS))
 		printf(" , pcnt = %"PRIu64" -- bcnt = %"PRIu64"",
 		       (uint64_t)cs.counters.pcnt, (uint64_t)cs.counters.bcnt);

Pablo Neira Ayuso

maintainer

2015-01-05 13:03 UTC #1 lore raw

Quoted 22 lines · Arturo Borrero Gonzalez

This patch fixes a segfault in rules without target.
Now, these two rules are allowed:
% ebtables-compat -A FORWARD -p 0x0600 -j CONTINUE % ebtables-compat -A FORWARD -p 0x0600
And both are printed:
Bridge chain: FORWARD, entries: 1, policy: ACCEPT
-p 0x600 -j CONTINUE
Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 iptables/nft-bridge.c |   10 ++++++++++
 1 file changed, 10 insertions(+)
iptables/nft-bridge.c +0 -0
index 90bcd63..79abf73 100644

iptables/nft-bridge.c static int _add_action(struct nft_rule *r, struct ebtables_command_state *cs) · line 121

Quoted 8 lines

iptables/nft-bridge.c +5 -0

@@ -114,6 +114,12 @@ static int _add_action(struct nft_rule *r, struct ebtables_command_state *cs)
 {
 	int ret = 0;
 
+	if (cs->jumpto == NULL)
+		return 0;
+
+	if (strcmp(cs->jumpto, "CONTINUE") == 0)
+		return 0;

Could you consolidate this code?

        if (cs->jumpto == NULL || strcmp(...) == 0)
                return 0;

iptables/nft-bridge.c static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num, · line 473

Quoted 11 lines

iptables/nft-bridge.c +4 -0

+
 	/* If no target at all, add nothing (default to continue) */
 	if (cs->target != NULL) {
 		/* Standard target? */

@@ -462,6 +468,10 @@ static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
 		}
 	}
 
+	if (strcmp(cs.jumpto, "") == 0) {
+		printf("CONTINUE");
+	}

You can remove the brackets, and...

        printf("-j ");
        if (!(format & FMT_NOTARGET))
                printf("%s", cs.jumpto); <----- is this handling this case?

        if (cs.target != NULL) {
                if (cs.target->print != NULL) {
                        cs.target->print(&cs.fw, cs.target->t,
                                            format & FMT_NUMERIC);
                }
        }

        if (strcmp(cs.jumpto, "") == 0)
                printf("CONTINUE");