firewall3: Fix GCC8 warnings by replacing sprintf with snprintf

[project/firewall3.git] / iptables.c

diff --git a/iptables.c b/iptables.c
index 319c5f6c98a553c39b26dee2a33384ee55211d76..adf64c05c4311ed75135cdb9c927da75ae4553c4 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -75,8 +75,12 @@ struct fw3_ipt_rule {
 };
 
 static struct option base_opts[] = {
-       { .name = "match",  .has_arg = 1, .val = 'm' },
-       { .name = "jump",   .has_arg = 1, .val = 'j' },
+       { .name = "match",         .has_arg = 1, .val = 'm' },
+       { .name = "jump",          .has_arg = 1, .val = 'j' },
+       { .name = "in-interface",  .has_arg = 1, .val = 'i' },
+       { .name = "out-interface", .has_arg = 1, .val = 'o' },
+       { .name = "source",        .has_arg = 1, .val = 's' },
+       { .name = "destination",   .has_arg = 1, .val = 'd' },
        { NULL }
 };
 
@@ -895,7 +899,7 @@ fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r,
                if (sp->port_min == sp->port_max)
                        sprintf(buf, "%u", sp->port_min);
                else
-                       sprintf(buf, "%u:%u", sp->port_min, sp->port_max);
+                       snprintf(buf, sizeof(buf), "%u:%u", sp->port_min, sp->port_max);
 
                fw3_ipt_rule_addarg(r, sp->invert, "--sport", buf);
        }
@@ -905,7 +909,7 @@ fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r,
                if (dp->port_min == dp->port_max)
                        sprintf(buf, "%u", dp->port_min);
                else
-                       sprintf(buf, "%u:%u", dp->port_min, dp->port_max);
+                       snprintf(buf, sizeof(buf), "%u:%u", dp->port_min, dp->port_max);
 
                fw3_ipt_rule_addarg(r, dp->invert, "--dport", buf);
        }
@@ -951,7 +955,7 @@ fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
                if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
                        sprintf(buf, "%u", icmp->type6);
                else
-                       sprintf(buf, "%u/%u", icmp->type6, icmp->code6_min);
+                       snprintf(buf, sizeof(buf), "%u/%u", icmp->type6, icmp->code6_min);
 
                fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf);
        }
@@ -961,7 +965,7 @@ fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
                if (icmp->code_min == 0 && icmp->code_max == 0xFF)
                        sprintf(buf, "%u", icmp->type);
                else
-                       sprintf(buf, "%u/%u", icmp->type, icmp->code_min);
+                       snprintf(buf, sizeof(buf), "%u/%u", icmp->type, icmp->code_min);
 
                fw3_ipt_rule_addarg(r, icmp->invert, "--icmp-type", buf);
        }
@@ -1021,6 +1025,16 @@ fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
        fw3_ipt_rule_addarg(r, false, buf, NULL);
 }
 
+void
+fw3_ipt_rule_helper(struct fw3_ipt_rule *r, struct fw3_cthelpermatch *match)
+{
+       if (!match || !match->set || !match->ptr)
+               return;
+
+       fw3_ipt_rule_addarg(r, false, "-m", "helper");
+       fw3_ipt_rule_addarg(r, match->invert, "--helper", match->ptr->name);
+}
+
 void
 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
 {
@@ -1409,7 +1423,7 @@ rule_mask(struct fw3_ipt_rule *r)
                        p += SZ(ip6t_entry_match) + m->match->size;
                }
 
-               memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target) ? r->target->userspacesize : 0);
+               memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target ? r->target->userspacesize : 0));
        }
        else
 #endif
@@ -1433,7 +1447,7 @@ rule_mask(struct fw3_ipt_rule *r)
                        p += SZ(ipt_entry_match) + m->match->size;
                }
 
-               memset(p, 0xFF, SZ(ipt_entry_target) + (r->target) ? r->target->userspacesize : 0);
+               memset(p, 0xFF, SZ(ipt_entry_target) + (r->target ? r->target->userspacesize : 0));
        }
 
        return mask;
@@ -1546,6 +1560,9 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
        struct xtables_target *et;
        struct xtables_globals *g;
 
+       struct fw3_device dev;
+       struct fw3_address addr;
+
        enum xtables_exittype status;
 
        int i, optc;
@@ -1573,7 +1590,7 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 
        set_rule_tag(r);
 
-       while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts,
+       while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts,
                                   NULL)) != -1)
        {
                switch (optc)
@@ -1601,6 +1618,34 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 
                        break;
 
+               case 'i':
+               case 'o':
+                       if (!fw3_parse_device(&dev, optarg, false) ||
+                           dev.any || dev.invert || *dev.network)
+                       {
+                               warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
+                               goto free;
+                       }
+
+                       dev.invert = inv;
+                       fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL,
+                                              (optc == 'o') ? &dev : NULL);
+                       break;
+
+               case 's':
+               case 'd':
+                       if (!fw3_parse_address(&addr, optarg, false) ||
+                           addr.range || addr.invert)
+                       {
+                               warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
+                               goto free;
+                       }
+
+                       addr.invert = inv;
+                       fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL,
+                                                (optc == 'd') ? &addr : NULL);
+                       break;
+
                case 1:
                        if ((optarg[0] == '!') && (optarg[1] == '\0'))
                        {