|
 |
621646 |
From 25af0fd3a7edd9a9aa5ed7ed63188456ee6389ef Mon Sep 17 00:00:00 2001
|
|
|
621646 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
621646 |
Date: Wed, 4 Dec 2019 09:56:06 +0100
|
|
|
621646 |
Subject: [PATCH] xtables-restore: Fix parser feed from line buffer
|
|
|
621646 |
|
|
|
621646 |
When called with --noflush, xtables-restore would trip over chain lines:
|
|
|
621646 |
Parser uses strtok() to separate chain name, policy and counters which
|
|
|
621646 |
inserts nul-chars into the source string. Therefore strlen() can't be
|
|
|
621646 |
used anymore to find end of line. Fix this by caching line length before
|
|
|
621646 |
calling xtables_restore_parse_line().
|
|
|
621646 |
|
|
|
621646 |
Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
|
|
|
621646 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
621646 |
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
621646 |
(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c)
|
|
|
621646 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
621646 |
---
|
|
|
621646 |
.../testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++
|
|
|
621646 |
iptables/xtables-restore.c | 4 +++-
|
|
|
621646 |
2 files changed, 13 insertions(+), 1 deletion(-)
|
|
|
621646 |
create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
|
|
621646 |
|
|
|
621646 |
diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
|
|
621646 |
new file mode 100755
|
|
|
621646 |
index 0000000000000..739e684a21183
|
|
|
621646 |
--- /dev/null
|
|
|
621646 |
+++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
|
|
621646 |
@@ -0,0 +1,10 @@
|
|
|
621646 |
+#!/bin/sh -e
|
|
|
621646 |
+
|
|
|
621646 |
+# assert input feed from buffer doesn't trip over
|
|
|
621646 |
+# added nul-chars from parsing chain line.
|
|
|
621646 |
+
|
|
|
621646 |
+$XT_MULTI iptables-restore --noflush <
|
|
|
621646 |
+*filter
|
|
|
621646 |
+:foobar - [0:0]
|
|
|
621646 |
+-A foobar -j ACCEPT
|
|
|
621646 |
+COMMIT
|
|
|
621646 |
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
|
|
621646 |
index 2f0fe7d439d94..dd907e0b8ddd5 100644
|
|
|
621646 |
--- a/iptables/xtables-restore.c
|
|
|
621646 |
+++ b/iptables/xtables-restore.c
|
|
|
621646 |
@@ -327,10 +327,12 @@ void xtables_restore_parse(struct nft_handle *h,
|
|
|
621646 |
line = 0;
|
|
|
621646 |
ptr = preload_buffer;
|
|
|
621646 |
while (*ptr) {
|
|
|
621646 |
+ size_t len = strlen(ptr);
|
|
|
621646 |
+
|
|
|
621646 |
h->error.lineno = ++line;
|
|
|
621646 |
DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr);
|
|
|
621646 |
xtables_restore_parse_line(h, p, &state, ptr);
|
|
|
621646 |
- ptr += strlen(ptr) + 1;
|
|
|
621646 |
+ ptr += len + 1;
|
|
|
621646 |
}
|
|
|
621646 |
if (*buffer) {
|
|
|
621646 |
h->error.lineno = ++line;
|
|
|
621646 |
--
|
|
|
621646 |
2.24.0
|
|
|
621646 |
|