[PATCH] save inverted MAC match

[PATCH] save inverted MAC match

[Michael Schwendt]

[-- Attachment #1: Type: text/plain, Size: 794 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The "mac" userspace extension contains a minor bug for both IPv4 and
IPv6. Upon printing/saving a rule which matches inverted MAC
addresses, a space character is missing between the '!' prefix and
the MAC address. Hence iptables-restore fails to parse the output of
iptables-save. iptables 1.2.5, 1.2.6a, 1.2.7a and CVS are affected.

Steps to reproduce:

  iptables -N test
  iptables -I test -m mac --mac-source ! 01:02:03:04:05:06
  iptables-save | iptables-restore

Further reference:

  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=77337

- -- 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)

iD8DBQE9yUF+0iMVcrivHFQRAoq1AJ44yEEvEBrsCcmVmKsOT1ouMgkZVACggArR
Wor0AECzGmXPdLCpo8qmwZQ=
=jYEu
-----END PGP SIGNATURE-----

[-- Attachment #2: iptables-1.2.7a-invertmac.patch --]
[-- Type: application/octet-stream, Size: 1049 bytes --]

Red Hat Linux bug #77337: Add missing space between '!' and MAC
address upon printing/saving rules.

diff -Naur iptables-1.2.7a-orig/extensions/libip6t_mac.c iptables-1.2.7a/extensions/libip6t_mac.c
--- iptables-1.2.7a-orig/extensions/libip6t_mac.c	Wed May 29 15:08:16 2002
+++ iptables-1.2.7a/extensions/libip6t_mac.c	Wed Nov  6 16:50:17 2002
@@ -90,7 +90,7 @@
 {
 	unsigned int i;
 
-	printf("%s%02X", invert ? "!" : "", macaddress[0]);
+	printf("%s%02X", invert ? "! " : "", macaddress[0]);
 	for (i = 1; i < ETH_ALEN; i++)
 		printf(":%02X", macaddress[i]);
 	printf(" ");
diff -Naur iptables-1.2.7a-orig/extensions/libipt_mac.c iptables-1.2.7a/extensions/libipt_mac.c
--- iptables-1.2.7a-orig/extensions/libipt_mac.c	Wed May 29 15:08:16 2002
+++ iptables-1.2.7a/extensions/libipt_mac.c	Wed Nov  6 16:50:30 2002
@@ -90,7 +90,7 @@
 {
 	unsigned int i;
 
-	printf("%s%02X", invert ? "!" : "", macaddress[0]);
+	printf("%s%02X", invert ? "! " : "", macaddress[0]);
 	for (i = 1; i < ETH_ALEN; i++)
 		printf(":%02X", macaddress[i]);
 	printf(" ");

Re: [PATCH] save inverted MAC match

[Michael Schwendt]

[-- Attachment #1: Type: text/plain, Size: 1101 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 6 Nov 2002 17:21:19 +0100, Michael Schwendt wrote:

> The "mac" userspace extension contains a minor bug for both IPv4 and
> IPv6. Upon printing/saving a rule which matches inverted MAC
> addresses, a space character is missing between the '!' prefix and
> the MAC address. Hence iptables-restore fails to parse the output of
> iptables-save. iptables 1.2.5, 1.2.6a, 1.2.7a and CVS are affected.
> 
> Steps to reproduce:
> 
>   iptables -N test
>   iptables -I test -m mac --mac-source ! 01:02:03:04:05:06
>   iptables-save | iptables-restore
> 
> Further reference:
> 
>   https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=77337

In CVS, only the IPv4 code has been fixed (somehow I've missed v1.8
of libipt_mac.c - don't know why).

The IPv6 code still contains the same bug (in CVS libip6t_mac.c
v1.5). Please don't forget to apply the patch. 

- -- 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)

iD8DBQE91Ccc0iMVcrivHFQRArM7AJ4x4n0YdhEYD45Bg3FYNKHgfky+9gCghax1
Thx88ZNFK4KpS2kSQXXlCgg=
=l7w/
-----END PGP SIGNATURE-----

[-- Attachment #2: iptables-1.2.7a-invertmac.patch --]
[-- Type: application/octet-stream, Size: 577 bytes --]

Red Hat Linux bug #77337: Add missing space between '!' and MAC
address upon printing/saving rules.

diff -Naur iptables-1.2.7a-orig/extensions/libip6t_mac.c iptables-1.2.7a/extensions/libip6t_mac.c
--- iptables-1.2.7a-orig/extensions/libip6t_mac.c	Wed May 29 15:08:16 2002
+++ iptables-1.2.7a/extensions/libip6t_mac.c	Wed Nov  6 16:50:17 2002
@@ -90,7 +90,7 @@
 {
 	unsigned int i;
 
-	printf("%s%02X", invert ? "!" : "", macaddress[0]);
+	printf("%s%02X", invert ? "! " : "", macaddress[0]);
 	for (i = 1; i < ETH_ALEN; i++)
 		printf(":%02X", macaddress[i]);
 	printf(" ");

Re: [PATCH] save inverted MAC match

[Michael Schwendt]

[-- Attachment #1: Type: text/plain, Size: 544 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In CVS, only the IPv4 code has been fixed. Hopefully this was the
last "missing space in saved rules" bug.

The patch is for current CVS codebase, both IPv6 and IPv4.

It's a bit longer again because it tidies up save() as used by
iptables-save without adding white-space in print() as used by
iptables -L.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)

iD8DBQE9+Mby0iMVcrivHFQRAprxAJ4viAlVrnJ9O+78kO+tKOO7XXgu7QCcCdbX
U8auSUapy/8PJFzbW1I95cQ=
=9r4z
-----END PGP SIGNATURE-----

[-- Attachment #2: iptables-CVS-invertmac.patch --]
[-- Type: application/octet-stream, Size: 2876 bytes --]

Add missing space in front of inverted MAC match upon saving rules,
but not upon printing rules.

diff -Naur iptables-CVS-orig/extensions/libip6t_mac.c iptables-CVS/extensions/libip6t_mac.c
--- iptables-CVS-orig/extensions/libip6t_mac.c	Thu Dec 12 17:52:50 2002
+++ iptables-CVS/extensions/libip6t_mac.c	Thu Dec 12 18:16:37 2002
@@ -86,11 +86,11 @@
 	return 1;
 }
 
-static void print_mac(unsigned char macaddress[ETH_ALEN], int invert)
+static void print_mac(unsigned char macaddress[ETH_ALEN])
 {
 	unsigned int i;
 
-	printf("%s%02X", invert ? "!" : "", macaddress[0]);
+	printf("%02X", macaddress[0]);
 	for (i = 1; i < ETH_ALEN; i++)
 		printf(":%02X", macaddress[i]);
 	printf(" ");
@@ -110,17 +110,23 @@
       const struct ip6t_entry_match *match,
       int numeric)
 {
+	struct ip6t_mac_info *info = (struct ip6t_mac_info *)match->data;
+	
 	printf("MAC ");
-	print_mac(((struct ip6t_mac_info *)match->data)->srcaddr,
-		  ((struct ip6t_mac_info *)match->data)->invert);
+	if ( info->invert )
+		printf("!");
+	print_mac(info->srcaddr);
 }
 
 /* Saves the union ip6t_matchinfo in parsable form to stdout. */
 static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
 {
+	struct ip6t_mac_info *info = (struct ip6t_mac_info *)match->data;
+	
 	printf("--mac-source ");
-	print_mac(((struct ip6t_mac_info *)match->data)->srcaddr,
-		  ((struct ip6t_mac_info *)match->data)->invert);
+	if ( info->invert )
+		printf("! ");
+	print_mac(info->srcaddr);
 }
 
 static
diff -Naur iptables-CVS-orig/extensions/libipt_mac.c iptables-CVS/extensions/libipt_mac.c
--- iptables-CVS-orig/extensions/libipt_mac.c	Thu Dec 12 17:54:07 2002
+++ iptables-CVS/extensions/libipt_mac.c	Thu Dec 12 18:14:51 2002
@@ -86,11 +86,11 @@
 	return 1;
 }
 
-static void print_mac(unsigned char macaddress[ETH_ALEN], int invert)
+static void print_mac(unsigned char macaddress[ETH_ALEN])
 {
 	unsigned int i;
 
-	printf("%s%02X", invert ? "! " : "", macaddress[0]);
+	printf("%02X", macaddress[0]);
 	for (i = 1; i < ETH_ALEN; i++)
 		printf(":%02X", macaddress[i]);
 	printf(" ");
@@ -110,17 +110,23 @@
       const struct ipt_entry_match *match,
       int numeric)
 {
+	struct ipt_mac_info *info = (struct ipt_mac_info *)match->data;
+	
 	printf("MAC ");
-	print_mac(((struct ipt_mac_info *)match->data)->srcaddr,
-		  ((struct ipt_mac_info *)match->data)->invert);
+	if ( info->invert )
+		printf("!");
+	print_mac(info->srcaddr);
 }
 
 /* Saves the union ipt_matchinfo in parsable form to stdout. */
 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 {
+	struct ipt_mac_info *info = (struct ipt_mac_info *)match->data;
+	
 	printf("--mac-source ");
-	print_mac(((struct ipt_mac_info *)match->data)->srcaddr,
-		  ((struct ipt_mac_info *)match->data)->invert);
+	if ( info->invert )
+		printf("! ");
+	print_mac(info->srcaddr);
 }
 
 static