From: Florian Westphal <fw@strlen.de>
To: Phil Sutter <phil@nwl.cc>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>,
netfilter-devel@vger.kernel.org, Florian Westphal <fw@strlen.de>
Subject: Re: [iptables PATCH v2] xtables-restore: Fix --table parameter check
Date: Mon, 21 Oct 2019 15:27:55 +0200 [thread overview]
Message-ID: <20191021132755.GE25052@breakpoint.cc> (raw)
In-Reply-To: <20191021132324.11039-1-phil@nwl.cc>
Phil Sutter <phil@nwl.cc> wrote:
> Xtables-restore tries to reject rule commands in input which contain a
> --table parameter (since it is adding this itself based on the previous
> table line). The manual check was not perfect though as it caught any
> parameter starting with a dash and containing a 't' somewhere, even in
> rule comments:
>
> | *filter
> | -A FORWARD -m comment --comment "- allow this one" -j ACCEPT
> | COMMIT
>
> Instead of error-prone manual checking, go a much simpler route: All
> do_command callbacks are passed a boolean indicating they're called from
> *tables-restore. React upon this when handling a table parameter and
> error out if it's not the first one.
>
> if (cs.invert)
> xtables_error(PARAMETER_PROBLEM,
> "unexpected ! flag before --table");
> + if (restore && *table)
> + xtables_error(PARAMETER_PROBLEM,
> + "The -t option (seen in line %u) cannot be used in %s.\n",
> + line, xt_params->program_name);
Oh, thats much better indeed.
Acked-by: Florian Westphal <fw@strlen.de>
prev parent reply other threads:[~2019-10-21 13:27 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-21 13:23 [iptables PATCH v2] xtables-restore: Fix --table parameter check Phil Sutter
2019-10-21 13:27 ` Florian Westphal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191021132755.GE25052@breakpoint.cc \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).