aboutsummaryrefslogtreecommitdiffstats
path: root/tc/m_xt.c
Commit message (Collapse)AuthorAgeFilesLines
* tc/m_xt: Fix for potential string buffer overflowsPhil Sutter2017-08-241-3/+4
| | | | | | | | | | | | - Use strncpy() when writing to target->t->u.user.name and make sure the final byte remains untouched (xtables_calloc() set it to zero). - 'tname' length sanitization was completely wrong: If it's length exceeded the 16 bytes available in 'k', passing a length value of 16 to strncpy() would overwrite the previously NULL'ed 'k[15]'. Also, the sanitization has to happen if 'tname' is exactly 16 bytes long as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Prevent a segfault in libiptPhil Sutter2017-05-301-1/+4
| | | | | | | | This happens with NAT targets, such as SNAT, DNAT and MASQUERADE. These are still not usable with this patch, but at least tc doesn't crash anymore when one tries to use them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Drop needless parentheses from #if checksPhil Sutter2017-01-131-4/+4
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Fix segfault with iptables-1.6.0Phil Sutter2017-01-121-0/+3
| | | | | | | | | | | | | Said iptables version introduced struct xtables_globals field 'compat_rev', a function pointer. Initializing it is mandatory as libxtables calls it without existence check. Without this, tc segfaults when using the xt action like so: | tc filter add dev d0 parent ffff: u32 match u32 0 0 \ | action xt -j MARK --set-mark 20 Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: pass correct conversion specifier to print 'unsigned int' action index.Roman Mashak2016-12-141-1/+1
| | | | | Signed-off-by: Roman Mashak <mrv@mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
* m_xt: whitespace cleanupStephen Hemminger2016-06-141-11/+21
| | | | Make it 99% checkpatch clean.
* tc: m_xt: Introduce get_xtables_target_opts()Phil Sutter2016-06-141-29/+29
| | | | | | | | | | This pulls common code from parse_ipt() and print_ipt() functions together. While here, also fix for incorrect use of the global 'optarg' variable in print_ipt(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Simplify argc adjusting in parse_ipt()Phil Sutter2016-06-141-11/+6
| | | | | | | And while at it, also improve the error message in case too few parameters have been given. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Get rid of iargc variable in parse_ipt()Phil Sutter2016-06-141-5/+4
| | | | | | | After dropping the unused decrement of argc in the function's tail, it can fully take over what iargc has been used for. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Get rid of rargc in parse_ipt()Phil Sutter2016-06-141-4/+3
| | | | | | | No need to copy the passed parameter, it's changed only once right before function return. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Drop unused variable fw in parse_ipt()Phil Sutter2016-06-141-2/+0
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Get rid of one indentation level in parse_ipt()Phil Sutter2016-06-141-46/+45
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Fix indentingPhil Sutter2016-06-141-28/+26
| | | | | | | | By exiting early if xtables_find_target() fails, one indenting level can be dropped. Some of the wrongly indented code then happens to sit at the right spot by accident which is why this patch is smaller than expected. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Fix segfault when adding multiple actions at oncePhil Sutter2016-06-141-6/+8
| | | | | | | | | | | | | | Without this, the following call to tc would segfault: | tc filter add dev d0 parent ffff: u32 match u32 0 0 \ | action xt -j MARK --set-mark 0x1 \ | action xt -j MARK --set-mark 0x1 The reason is basically the same as for 6e2e5ec28bad4 ("fix print_ipt: segfault if more then one filter with action -j MARK.") but in parse_ipt() instead of print_ipt(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: m_xt: Prevent segfault with standard targetsPhil Sutter2016-06-141-2/+6
| | | | | | | | | | | | Iptables standard targets like DROP or REJECT don't implement the print callback in libxtables. Hence the following command would segfault: | tc filter add dev d0 parent ffff: u32 match u32 0 0 action xt -j DROP With this patch standard targets still can't be used (and are not really useful anyway), but at least it doesn't crash anymore. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tc: code cleanupStephen Hemminger2016-03-211-29/+36
| | | | Use checkpatch to fix whitespace and other style issues.
* whitespace cleanupStephen Hemminger2014-12-201-1/+1
| | | | Remove all trailing whitespace and space before tabs.
* tc: minor spelling fixesStephen Hemminger2014-12-031-2/+2
|
* fix print_ipt: segfault if more then one filter with action -j MARK.Andreas Greve2014-05-131-5/+8
| | | | | | | | | | | | | | | | | | | | BUG: tc filter show ... produce a segmentation fault if more than one filter rule with action -j MARK exists. Reason: In print_ipt(...) xtables will be initialzed with a pointer to the static struct tcipt_globals at xtables_init_all(). Later on the fields .opts and .options_offset of tcipt_globals are modified. The call of xtables_free_opts(1) at the end of print(...) does not restore the original values of tcipt_globals for the modified fields. It only frees some allocated memory and sets .opts to NULL. This leads to a segmentation fault when print_ipt() is called for the next filter rule with action -j MARK. Fix: Cloneing tcipt_globals on the stack as tmp_tcipt_globals and use it instead of tcipt_globals, so tcipt_globals will be not modified. Signed-off-by: Andreas Greve <andreas.greve@a-greve.de>
* More minor spelling fixesStephen Hemminger2013-08-041-1/+1
|
* iproute2: act_ipt fix xtables breakage on older versions.Alexander Duyck2013-05-011-6/+8
| | | | | | | | | | | | | | | | | | | | | | In trying to build on a RHEL6.3 I ran into several build issues that are addressed in this patch. The first is that xtables_merge_options only has 3 parameters. It appears this is how this code was originally. As such for the case where the version is less than 6 I am assuming it would be correct to maintain the original setup that only had 3 parameters being passed instead of 4. I also ran into an issue with the define for __ALIGN_KERNEL not being present. I believe this may be due to the fact that __ALIGN_KERNEL was moved into a separate header from ALIGN after the UAPI changes. In order to just cover all of the bases I have moved the main definition for the macros into __ALIGN_KERNEL_MASK and __ALIGN_KERNEL and if ALIGN is also needed then it is just a direct redefine to __ALIGN_KERNEL. Cc: Hasan Chowdhury <shemonc@gmail.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
* ip: make local functions staticStephen Hemminger2013-02-121-2/+2
|
* iproute2: act_ipt fix xtables breakageJamal Hadi Salim2013-01-161-18/+45
| | | | | | | Fixes breakage with xtables API starting with version 1.4.10 Signed-off-by: Hasan Chowdhury <shemonc@gmail.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
* Convert to use rta_getattr_ functionsStephen Hemminger2012-04-101-3/+3
| | | | | User new functions (inspired by libmnl) to do type safe access of routeing attributes
* iproute2: fix calling up the xt actionJan Engelhardt2012-01-031-2/+2
| | | | | | | Upsteam: has not been sent yet Requesting the xt action never succeeded because it registered using the wrong name.
* xt: only unset fields if m is non NULLDan McGee2011-08-311-6/+8
|
* Remove redundant limits.hStephen Hemminger2011-07-131-1/+0
| | | | redo.
* iproute2: Fix building xt module against xtables version 6Andreas Henriksson2011-07-111-4/+12
| | | | | | | | | | | | | | | | | | | iptables/xtables apparently changed API again.... Now you need to pass and extra parameter (orig_opts) which was not needed before. Sprinkle some lovely pre-processor magic to be compatible with both older and new versions. In the beginning of times XTABLES_VERSION_CODE didn't exist. Then it was (0x10000 * major + 0x100 * minor + patch) when it was first introduced (according to git), but now it's at 6... Don't know what official iptables releases has defined it to over time. Lets just hope none of the older versions with is has the define higher then 6 is still around.... so only the "current" versioning scheme is supported.... lets see how long this lasts now. For the API change in xtables, see: http://git.netfilter.org/cgi-bin/gitweb.cgi?p=iptables.git;a=commitdiff;h=600f38db82548a683775fd89b6e136673e924097 Signed-off-by: Andreas Henriksson <andreas@fatal.se>
* xt match: fix set-never-used warningStephen Hemminger2011-06-291-2/+0
|
* m_xt: stop using xtables_set_revision()Mike Frysinger2010-11-301-1/+1
| | | | | | | | iptables dropped the xtables_set_revision() function around version 1.4.9, so set the rev directly ourselves. This should be compatible back to the original version m_xt itself is designed for. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Workaround missing ALIGN() macroStephen Hemminger2010-03-291-0/+5
| | | | XT_ALIGN() calls ALIGN macro but ALIGN is in kernel source not userspace.
* Add new (iptables 1.4.5 compatible) tc/ipt/xt module.Andreas Henriksson2009-12-261-0/+346
| | | | | | | | | | | | | Add a new cleaned up m_xt.c based on m_xt_old.c The new m_xt.c has been updated to use the new names and new api that xtables exposes in iptables 1.4.5. All the old internal api cruft has also been dropped. Additionally, a configure script test is added to check for the new xtables api and set the TC_CONFIG_XT flag in Config. (tc/Makefile already handles this flag in previous commit.) Signed-off-by: Andreas Henriksson <andreas@fatal.se>
* Keep the old tc/ipt/xt module for compatibility.Andreas Henriksson2009-12-261-433/+0
| | | | | | | Move the file and rename the configure flags. The file is being kept around for iptables < 1.4.5 compatibility. Signed-off-by: Andreas Henriksson <andreas@fatal.se>
* tc: remove dlfcn.h from files that dont need itMike Frysinger2009-11-131-1/+0
| | | | | | | | | A bunch of source files look like they're copy & pasted from other files, and some include header files that they don't actually need. Since dlfcn has very specific usage (and is a pain on a static-only system), drop it where it isn't really needed. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* remove duplicate limits.hStephen Hemminger2009-03-271-1/+0
|
* Add missing limits.hStephen Hemminger2009-03-011-0/+1
| | | | Need limits.h to get INT_MIN on Debian
* Breakage noticed when debian upgraded to xtables (iptables > 1.4.1)Jamal Hadi Salim2009-02-191-0/+434
Many thanks to Yevgeny Kosarzhevsky <yevg@pisem.net> for reporting and a lot of testing Thanks to Jan Engelhardt <jengelh@medozas.de> for a lot of advice Thanks to Denys Fedoryschenko <denys@visp.net.lb> for some sample code that he tried and thanks to Andreas Henriksson <andreas@fatal.se> (who maintains iproute2 on debian) for the persistent followup. Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 16:44:52 +0000