interface-ip: fix memory corruption bug when using jail network namespaces

[project/netifd.git] / iprule.c

diff --git a/iprule.c b/iprule.c
index c3a629f6103624e6cb8578959ecd3ed4c814bf7a..095607373f417a7036441d17ab3c650a7d6a143a 100644 (file)
--- a/iprule.c
+++ b/iprule.c
@@ -44,6 +44,8 @@ enum {
        RULE_ACTION,
        RULE_GOTO,
        RULE_SUP_PREFIXLEN,
+       RULE_UIDRANGE,
+       RULE_DISABLED,
        __RULE_MAX
 };
 
@@ -58,8 +60,10 @@ static const struct blobmsg_policy rule_attr[__RULE_MAX] = {
        [RULE_FWMARK] = { .name = "mark", .type = BLOBMSG_TYPE_STRING },
        [RULE_LOOKUP] = { .name = "lookup", .type = BLOBMSG_TYPE_STRING },
        [RULE_SUP_PREFIXLEN] = { .name = "suppress_prefixlength", .type = BLOBMSG_TYPE_INT32 },
+       [RULE_UIDRANGE] = { .name = "uidrange", .type = BLOBMSG_TYPE_STRING },
        [RULE_ACTION] = { .name = "action", .type = BLOBMSG_TYPE_STRING },
        [RULE_GOTO]   = { .name = "goto", .type = BLOBMSG_TYPE_INT32 },
+       [RULE_DISABLED] = { .name = "disabled", .type = BLOBMSG_TYPE_BOOL },
 };
 
 const struct uci_blob_param_list rule_attr_list = {
@@ -203,6 +207,9 @@ iprule_add(struct blob_attr *attr, bool v6)
 
        blobmsg_parse(rule_attr, __RULE_MAX, tb, blobmsg_data(attr), blobmsg_data_len(attr));
 
+       if ((cur = tb[RULE_DISABLED]) != NULL && blobmsg_get_bool(cur))
+               return;
+
        rule = calloc(1, sizeof(*rule));
        if (!rule)
                return;
@@ -277,6 +284,18 @@ iprule_add(struct blob_attr *attr, bool v6)
                rule->flags |= IPRULE_SUP_PREFIXLEN;
        }
 
+       if ((cur = tb[RULE_UIDRANGE]) != NULL) {
+               int ret = sscanf(blobmsg_get_string(cur), "%u-%u", &rule->uidrange_start, &rule->uidrange_end);
+
+               if (ret == 1)
+                       rule->uidrange_end = rule->uidrange_start;
+               else if (ret != 2) {
+                       DPRINTF("Failed to parse UID range: %s\n", (char *) blobmsg_data(cur));
+                       goto error;
+               }
+               rule->flags |= IPRULE_UIDRANGE;
+       }
+
        if ((cur = tb[RULE_ACTION]) != NULL) {
                if (!system_resolve_iprule_action(blobmsg_data(cur), &rule->action)) {
                        DPRINTF("Failed to parse rule action: %s\n", (char *) blobmsg_data(cur));