[PATCH] disallow multiple matches of same type

[PATCH] disallow multiple matches of same type

[Phil Oester]

[-- Attachment #1: Type: text/plain, Size: 375 bytes --]

In latest iptables SVN, the command:

iptables -A foo -p tcp -m multiport --dport 45,47 -m multiport --sport 45:48

ends up with mangled results of:

... multiport sports  multiport sports  tcp spts:45:48

Since at present, iptables can only handle one match of a given type
per rule.  The below patch makes sure we disallow more than one.

This closes bugzilla #447

Phil



[-- Attachment #2: patch-nomultimatch --]
[-- Type: text/plain, Size: 564 bytes --]

--- ipt-orig/iptables.c	2006-02-11 01:50:11.000000000 -0800
+++ ipt-new/iptables.c	2006-02-19 21:46:03.000000000 -0800
@@ -2125,6 +2125,11 @@
 				exit_error(PARAMETER_PROBLEM,
 					   "unexpected ! flag before --match");
 
+			for (matchp = matches; matchp; matchp = matchp->next) {
+				if (strcmp(optarg, matchp->match->name) == 0)
+					exit_error(PARAMETER_PROBLEM,
+						   "multiple matches of same type not supported");
+			}
 			m = find_match(optarg, LOAD_MUST_SUCCEED, &matches);
 			size = IPT_ALIGN(sizeof(struct ipt_entry_match))
 					 + m->size;

Re: [PATCH] disallow multiple matches of same type

[Patrick McHardy]

Phil Oester wrote:
> In latest iptables SVN, the command:
> 
> iptables -A foo -p tcp -m multiport --dport 45,47 -m multiport --sport 45:48
> 
> ends up with mangled results of:
> 
> ... multiport sports  multiport sports  tcp spts:45:48
> 
> Since at present, iptables can only handle one match of a given type
> per rule.  The below patch makes sure we disallow more than one.
> 
> This closes bugzilla #447

I think Harald already did something in this direction. Harald?

Re: [PATCH] disallow multiple matches of same type

[Phil Oester]

On Mon, Feb 20, 2006 at 06:38:22PM +0100, Patrick McHardy wrote:
> I think Harald already did something in this direction. Harald?

He corrected it so iptables didn't segfault, and opened a new bug
for the incorrect behaviour.  This fixes that new bug.

Phil

Re: [PATCH] disallow multiple matches of same type

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 762 bytes --]

On Mon, Feb 20, 2006 at 10:31:22AM -0800, Phil Oester wrote:
> On Mon, Feb 20, 2006 at 06:38:22PM +0100, Patrick McHardy wrote:
> > I think Harald already did something in this direction. Harald?
> 
> He corrected it so iptables didn't segfault, and opened a new bug
> for the incorrect behaviour.  This fixes that new bug.

that's correct. Haven't reviewed your bugfix yet, though.
-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]