Re: [PATCH/RFC/RFT] add "revision" support to arp_tables and ip6_tables

[Carl-Daniel Hailfinger <c-d.hailfinger.devel.2005@gmx.net>]

Hi,

Harald Welte schrieb:
> 
> I've added "revision" (i.e. support for multiple match/target versions)
> to arp_tables and ip6_tables.
> 
> At least according to some simple tests, I didn't break anything.  It's
> already in my git tree's 'master' branch, and I intend to submit it
> during early 2.6.15.
> 
> Please test/comment/fix,
> 	Harald
> 
> 
> [NETFILTER] {ip6,arp}_tables: Add support for match/target revisions
> 
> This patch synchronizes {ip6,arp}_tables with recent changes in ip_tables.
> It adds support for multiple revisions per match/target.
> 
> diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
> --- a/include/linux/netfilter_arp/arp_tables.h
> +++ b/include/linux/netfilter_arp/arp_tables.h
> @@ -68,7 +68,8 @@ struct arpt_entry_target
>  			u_int16_t target_size;
>  
>  			/* Used by userspace */
> -			char name[ARPT_FUNCTION_MAXNAMELEN];
> +			char name[ARPT_FUNCTION_MAXNAMELEN-1];
> +			u_int8_t revision;
>  		} user;
>  		struct {
>  			u_int16_t target_size;

This will explode once revision!=0 because the string stored in name is 
not NULL-terminated anymore if it is ARPT_FUNCTION_MAXNAMELEN-1 long.


Regards,
Carl-Daniel