iptables: fix regression with unintended free in need_protomatch

[project/firewall3.git] / rules.c

diff --git a/rules.c b/rules.c
index 5af8bfd952623d625b538f4968e7180ef6407225..d506a961d845dd71576c0b87177c3cdcf4c0d9ff 100644 (file)
--- a/rules.c
+++ b/rules.c
@@ -170,13 +170,6 @@ check_rule(struct fw3_state *state, struct fw3_rule *r, struct uci_element *e)
                return false;
        }
 
-       if (r->_dest && (r->target == FW3_FLAG_MARK || r->target == FW3_FLAG_DSCP))
-       {
-               warn_section("rule", r, e, "must not specify 'dest' for %s target",
-                            fw3_flag_names[r->target]);
-               return false;
-       }
-
        if (r->set_mark.invert || r->set_xmark.invert || r->set_dscp.invert)
        {
                warn_section("rule", r, e, "must not have inverted 'set_mark', "
@@ -200,7 +193,7 @@ check_rule(struct fw3_state *state, struct fw3_rule *r, struct uci_element *e)
        if (!r->_src && !r->_dest && !r->src.any && !r->dest.any)
        {
                warn_section("rule", r, e, "has neither a source nor a destination zone assigned "
-                               "- assuming an output r");
+                               "- assuming an output rule");
        }
 
        if (list_empty(&r->proto))
@@ -309,10 +302,19 @@ append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule)
        {
                snprintf(chain, sizeof(chain), "zone_%s_helper", rule->src.name);
        }
-       else if ((rule->target == FW3_FLAG_MARK || rule->target == FW3_FLAG_DSCP) &&
-                (rule->_src || rule->src.any))
+       else if (rule->target == FW3_FLAG_MARK || rule->target == FW3_FLAG_DSCP)
        {
-               snprintf(chain, sizeof(chain), "PREROUTING");
+               if ((rule->_dest && rule->_src) ||
+                   (rule->dest.any && rule->src.any))
+                       snprintf(chain, sizeof(chain), "FORWARD");
+               else if (rule->src.any && rule->_dest)
+                       snprintf(chain, sizeof(chain), "POSTROUTING");
+               else if (rule->dest.any && rule->_src)
+                       snprintf(chain, sizeof(chain), "PREROUTING");
+               else if (!rule->dest.set && rule->src.set)
+                       snprintf(chain, sizeof(chain), "INPUT");
+               else /* if (!rule->src.set) */
+                       snprintf(chain, sizeof(chain), "OUTPUT");
        }
        else
        {
@@ -353,21 +355,21 @@ static void set_target(struct fw3_ipt_rule *r, struct fw3_rule *rule)
 {
        const char *name;
        struct fw3_mark *mark;
-       char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
+       char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF")];
 
        switch(rule->target)
        {
        case FW3_FLAG_MARK:
                name = rule->set_mark.set ? "--set-mark" : "--set-xmark";
                mark = rule->set_mark.set ? &rule->set_mark : &rule->set_xmark;
-               sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
+               snprintf(buf, sizeof(buf), "0x%x/0x%x", mark->mark, mark->mask);
 
                fw3_ipt_rule_target(r, "MARK");
                fw3_ipt_rule_addarg(r, false, name, buf);
                return;
 
        case FW3_FLAG_DSCP:
-               sprintf(buf, "0x%x", rule->set_dscp.dscp);
+               snprintf(buf, sizeof(buf), "0x%x", rule->set_dscp.dscp);
 
                fw3_ipt_rule_target(r, "DSCP");
                fw3_ipt_rule_addarg(r, false, "--set-dscp", buf);
@@ -420,6 +422,10 @@ print_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
            struct fw3_mac *mac, struct fw3_icmptype *icmptype)
 {
        struct fw3_ipt_rule *r;
+       struct fw3_device *idev, *odev;
+       struct list_head empty, *idevices, *odevices;
+       INIT_LIST_HEAD(&empty);
+       idevices = odevices = ∅
 
        if (!fw3_is_family(sip, handle->family) ||
            !fw3_is_family(dip, handle->family))
@@ -471,21 +477,33 @@ print_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                return;
        }
 
-       r = fw3_ipt_rule_create(handle, proto, NULL, NULL, sip, dip);
-       fw3_ipt_rule_sport_dport(r, sport, dport);
-       fw3_ipt_rule_device(r, rule->device, rule->direction_out);
-       fw3_ipt_rule_icmptype(r, icmptype);
-       fw3_ipt_rule_mac(r, mac);
-       fw3_ipt_rule_ipset(r, &rule->ipset);
-       fw3_ipt_rule_helper(r, &rule->helper);
-       fw3_ipt_rule_limit(r, &rule->limit);
-       fw3_ipt_rule_time(r, &rule->time);
-       fw3_ipt_rule_mark(r, &rule->mark);
-       fw3_ipt_rule_dscp(r, &rule->dscp);
-       set_target(r, rule);
-       fw3_ipt_rule_extra(r, rule->extra);
-       set_comment(r, rule->name, num);
-       append_chain(r, rule);
+       if (rule->target == FW3_FLAG_DSCP || rule->target == FW3_FLAG_MARK)
+       {
+               if (rule->_src)
+                       idevices = &rule->_src->devices;
+               if (rule->_dest)
+                       odevices = &rule->_dest->devices;
+       }
+
+       fw3_foreach(idev, idevices)
+       fw3_foreach(odev, odevices)
+       {
+               r = fw3_ipt_rule_create(handle, proto, idev, odev, sip, dip);
+               fw3_ipt_rule_sport_dport(r, sport, dport);
+               fw3_ipt_rule_device(r, rule->device, rule->direction_out);
+               fw3_ipt_rule_icmptype(r, icmptype);
+               fw3_ipt_rule_mac(r, mac);
+               fw3_ipt_rule_ipset(r, &rule->ipset);
+               fw3_ipt_rule_helper(r, &rule->helper);
+               fw3_ipt_rule_limit(r, &rule->limit);
+               fw3_ipt_rule_time(r, &rule->time);
+               fw3_ipt_rule_mark(r, &rule->mark);
+               fw3_ipt_rule_dscp(r, &rule->dscp);
+               set_target(r, rule);
+               fw3_ipt_rule_extra(r, rule->extra);
+               set_comment(r, rule->name, num);
+               append_chain(r, rule);
+       }
 }
 
 static void