* [ebtables-compat PATCH] ebtables-compat: fix segfault in rules w/o target
@ 2014-12-30 15:44 Arturo Borrero Gonzalez
2015-01-05 13:05 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Arturo Borrero Gonzalez @ 2014-12-30 15:44 UTC (permalink / raw)
To: netfilter-devel; +Cc: giuseppelng, pablo
This patch fixes a segfault in rules without target.
Now, these two rules are allowed:
% ebtables-compat -A FORWARD -p 0x0600 -j CONTINUE
% ebtables-compat -A FORWARD -p 0x0600
And both are printed:
Bridge chain: FORWARD, entries: 1, policy: ACCEPT
-p 0x600 -j CONTINUE
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
iptables/nft-bridge.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
index 90bcd63..79abf73 100644
--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
@@ -114,6 +114,12 @@ static int _add_action(struct nft_rule *r, struct ebtables_command_state *cs)
{
int ret = 0;
+ if (cs->jumpto == NULL)
+ return 0;
+
+ if (strcmp(cs->jumpto, "CONTINUE") == 0)
+ return 0;
+
/* If no target at all, add nothing (default to continue) */
if (cs->target != NULL) {
/* Standard target? */
@@ -462,6 +468,10 @@ static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
}
}
+ if (strcmp(cs.jumpto, "") == 0) {
+ printf("CONTINUE");
+ }
+
if (!(format & FMT_NOCOUNTS))
printf(" , pcnt = %"PRIu64" -- bcnt = %"PRIu64"",
(uint64_t)cs.counters.pcnt, (uint64_t)cs.counters.bcnt);
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [ebtables-compat PATCH] ebtables-compat: fix segfault in rules w/o target
2014-12-30 15:44 [ebtables-compat PATCH] ebtables-compat: fix segfault in rules w/o target Arturo Borrero Gonzalez
@ 2015-01-05 13:05 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2015-01-05 13:05 UTC (permalink / raw)
To: Arturo Borrero Gonzalez; +Cc: netfilter-devel, giuseppelng
On Tue, Dec 30, 2014 at 04:44:44PM +0100, Arturo Borrero Gonzalez wrote:
> This patch fixes a segfault in rules without target.
>
> Now, these two rules are allowed:
>
> % ebtables-compat -A FORWARD -p 0x0600 -j CONTINUE
> % ebtables-compat -A FORWARD -p 0x0600
>
> And both are printed:
>
> Bridge chain: FORWARD, entries: 1, policy: ACCEPT
> -p 0x600 -j CONTINUE
>
> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
> ---
> iptables/nft-bridge.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
> index 90bcd63..79abf73 100644
> --- a/iptables/nft-bridge.c
> +++ b/iptables/nft-bridge.c
> @@ -114,6 +114,12 @@ static int _add_action(struct nft_rule *r, struct ebtables_command_state *cs)
> {
> int ret = 0;
>
> + if (cs->jumpto == NULL)
> + return 0;
> +
> + if (strcmp(cs->jumpto, "CONTINUE") == 0)
> + return 0;
Could you consolidate this code?
if (cs->jumpto == NULL || strcmp(...) == 0)
return 0;
> +
> /* If no target at all, add nothing (default to continue) */
> if (cs->target != NULL) {
> /* Standard target? */
> @@ -462,6 +468,10 @@ static void nft_bridge_print_firewall(struct nft_rule *r, unsigned int num,
> }
> }
>
> + if (strcmp(cs.jumpto, "") == 0) {
> + printf("CONTINUE");
> + }
You can remove the brackets, and...
printf("-j ");
if (!(format & FMT_NOTARGET))
printf("%s", cs.jumpto); <----- is this handling this case?
if (cs.target != NULL) {
if (cs.target->print != NULL) {
cs.target->print(&cs.fw, cs.target->t,
format & FMT_NUMERIC);
}
}
if (strcmp(cs.jumpto, "") == 0)
printf("CONTINUE");
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-01-05 13:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-30 15:44 [ebtables-compat PATCH] ebtables-compat: fix segfault in rules w/o target Arturo Borrero Gonzalez
2015-01-05 13:05 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).