[PATCH] nftables: allow protocols by number in inet_protocol_type_parse

[PATCH] nftables: allow protocols by number in inet_protocol_type_parse

[Phil Oester]

[-- Attachment #1: Type: text/plain, Size: 295 bytes --]

nftables does not currently allow specifying protocols by number.  Below
patch adds this capability.

Phil

Signed-off-by: Phil Oester <kernel@linuxace.com>

---
Note the errno include is duplicated in this patch and my earlier
"nftables: validate port number in inet_service_type_parse" patch.

[-- Attachment #2: patch-nft-inet_protocol_type_parse --]
[-- Type: text/plain, Size: 1178 bytes --]

diff --git a/src/datatype.c b/src/datatype.c
index 55368ee..0a1cf2d 100644
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -11,6 +11,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <inttypes.h>
+#include <errno.h>
 #include <netdb.h>
 #include <arpa/inet.h>
 #include <linux/types.h>
@@ -457,14 +458,28 @@ static struct error_record *inet_protocol_type_parse(const struct expr *sym,
 						     struct expr **res)
 {
 	struct protoent *p;
-
-	p = getprotobyname(sym->identifier);
-	if (p == NULL)
-		return error(&sym->location, "Could not resolve protocol name");
+	uint8_t proto;
+	uintmax_t i;
+	char *end;
+
+	errno = 0;
+	i = strtoumax(sym->identifier, &end, 0);
+	if (sym->identifier != end && *end == '\0') {
+		if (errno == ERANGE || i > UINT8_MAX)
+			return error(&sym->location, "Protocol out of range");
+
+		proto = i;
+	} else {
+		p = getprotobyname(sym->identifier);
+		if (p == NULL)
+			return error(&sym->location, "Could not resolve protocol name");
+
+		proto = p->p_proto;
+	}
 
 	*res = constant_expr_alloc(&sym->location, &inet_protocol_type,
 				   BYTEORDER_HOST_ENDIAN, BITS_PER_BYTE,
-				   &p->p_proto);
+				   &proto);
 	return NULL;
 }
 

Re: [PATCH] nftables: allow protocols by number in inet_protocol_type_parse

[Pablo Neira Ayuso]

On Thu, Aug 15, 2013 at 04:09:07PM -0700, Phil Oester wrote:
> nftables does not currently allow specifying protocols by number.  Below
> patch adds this capability.

Also applied, thanks.

[...]
> Note the errno include is duplicated in this patch and my earlier
> "nftables: validate port number in inet_service_type_parse" patch.

No problem, I have removed that chunk.