60 lines
2.2 KiB
Diff
60 lines
2.2 KiB
Diff
From 25af0fd3a7edd9a9aa5ed7ed63188456ee6389ef Mon Sep 17 00:00:00 2001
|
|
From: Phil Sutter <phil@nwl.cc>
|
|
Date: Wed, 4 Dec 2019 09:56:06 +0100
|
|
Subject: [PATCH] xtables-restore: Fix parser feed from line buffer
|
|
|
|
When called with --noflush, xtables-restore would trip over chain lines:
|
|
Parser uses strtok() to separate chain name, policy and counters which
|
|
inserts nul-chars into the source string. Therefore strlen() can't be
|
|
used anymore to find end of line. Fix this by caching line length before
|
|
calling xtables_restore_parse_line().
|
|
|
|
Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
|
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c)
|
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
---
|
|
.../testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++
|
|
iptables/xtables-restore.c | 4 +++-
|
|
2 files changed, 13 insertions(+), 1 deletion(-)
|
|
create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
|
|
|
diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
|
new file mode 100755
|
|
index 0000000000000..739e684a21183
|
|
--- /dev/null
|
|
+++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
|
@@ -0,0 +1,10 @@
|
|
+#!/bin/sh -e
|
|
+
|
|
+# assert input feed from buffer doesn't trip over
|
|
+# added nul-chars from parsing chain line.
|
|
+
|
|
+$XT_MULTI iptables-restore --noflush <<EOF
|
|
+*filter
|
|
+:foobar - [0:0]
|
|
+-A foobar -j ACCEPT
|
|
+COMMIT
|
|
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
|
index 2f0fe7d439d94..dd907e0b8ddd5 100644
|
|
--- a/iptables/xtables-restore.c
|
|
+++ b/iptables/xtables-restore.c
|
|
@@ -327,10 +327,12 @@ void xtables_restore_parse(struct nft_handle *h,
|
|
line = 0;
|
|
ptr = preload_buffer;
|
|
while (*ptr) {
|
|
+ size_t len = strlen(ptr);
|
|
+
|
|
h->error.lineno = ++line;
|
|
DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr);
|
|
xtables_restore_parse_line(h, p, &state, ptr);
|
|
- ptr += strlen(ptr) + 1;
|
|
+ ptr += len + 1;
|
|
}
|
|
if (*buffer) {
|
|
h->error.lineno = ++line;
|
|
--
|
|
2.24.0
|
|
|