extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-01-23 05:58:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Centralize the validation of nfacct object names.

Browse Source 
- Also correct a missing ' ' from the output generated by INLINE
  freeform input.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-04-26 09:09:08 -07:00
parent b57fd9f2a9
commit 20d38e8b52
4 changed files with 29 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Shorewall/Perl/Shorewall/Accounting.pm
View File

@ -235,15 +235,12 @@ sub process_accounting_rule1( $$$$$$$$$$$ ) {
require_capability 'NFACCT_MATCH', 'The NFACCT action', 's';
$target = '';
for ( my @objects = split_nfacct_list $1 ) {
if ( $_ =~ /^([\w%&@~]+)(!)?$/ ) {
if ( $2 ) {
$prerule .= "-m nfacct --nfacct-name $1 ";
} else {
$rule .= "-m nfacct --nfacct-name $1 ";
}
} else {
fatal_error "Invalid nfacct object name ($_)";
}
validate_nfobject( $_, 1 );
if ( s/!$// ) {
$prerule .= "-m nfacct --nfacct-name $_ ";
} else {
$rule .= "-m nfacct --nfacct-name $_ ";
}
}
} elsif ( $action eq 'INLINE' ) {
$rule .= get_inline_matches;

36
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -248,6 +248,7 @@ our %EXPORT_TAGS = (
set_global_variables
save_dynamic_chains
load_ipsets
validate_nfobject
create_nfobjects
create_netfilter_load
preview_netfilter_load
@ -780,6 +781,17 @@ sub record_nfobject( $ ) {
$nfobjects{$value[-1]} = 1;
}
#
# Validate and register an nfacct object name
#
sub validate_nfobject( $;$ ) {
my ( $name, $allowbang ) = @_;
fatal_error "Invalid nfacct object name ($name)" unless $name =~ /^[-\w%&@~]+(!)?$/ && ( $allowbang || ! $1 );
$nfobjects{$_} = 1;
}
# # Next a helper for setting an individual option
#
sub set_rule_option( $$$ ) {
@ -5440,9 +5452,8 @@ sub match_source_net( $;$\$ ) {
if ( $3 ) {
require_capability 'NFACCT_MATCH', "An nfacct object list ($3)", 's';
for ( my @objects = split_list $3, 'nfacct' ) {
fatal_error "Invalid nfacct object name ($_)" unless /^[\w%&@~]+$/;
validate_nfobject( $_ );
$result .= "-m nfacct --nfacct-name $_ ";
$nfobjects{$_} = 1;
}
}
@ -5461,9 +5472,8 @@ sub match_source_net( $;$\$ ) {
if ( $3 ) {
require_capability 'NFACCT_MATCH', "An nfacct object list ($3)", 's';
for ( my @objects = split_list $3, 'nfacct' ) {
fatal_error "Invalid nfacct object name ($_)" unless /^[\w%&@~]+$/;
validate_nfobject( $_ );
$result .= "-m nfacct --nfacct-name $_ ";
$nfobjects{$_} = 1;
}
}
}
@ -5531,9 +5541,8 @@ sub imatch_source_net( $;$\$ ) {
if ( $3 ) {
require_capability 'NFACCT_MATCH', "An nfacct object list ($3)", 's';
for ( my @objects = split_list $3, 'nfacct' ) {
fatal_error "Invalid nfacct object name ($_)" unless /^[\w%&@~]+$/;
validate_nfobject( $_ );
push( @result, ( nfacct => "--nfacct-name $_" ) );
$nfobjects{$_} = 1;
}
}
@ -5552,9 +5561,8 @@ sub imatch_source_net( $;$\$ ) {
if ( $3 ) {
require_capability 'NFACCT_MATCH', "An nfacct object list ($3)", 's';
for ( my @objects = split_list $3, 'nfacct' ) {
fatal_error "Invalid nfacct object name ($_)" unless /^[\w%&@~]+$/;
validate_nfobject( $_ );
push( @result, ( nfacct => "--nfacct-name $_" ) );
$nfobjects{$_} = 1;
}
}
}
@ -5618,9 +5626,8 @@ sub match_dest_net( $;$ ) {
if ( $3 ) {
require_capability 'NFACCT_MATCH', "An nfacct object list ($3)", 's';
for ( my @objects = split_list $3, 'nfacct' ) {
fatal_error "Invalid nfacct object name ($_)" unless /^[\w%&@~]+$/;
validate_nfobject( $_ );
$result .= "-m nfacct --nfacct-name $_ ";
$nfobjects{$_} = 1;
}
}
@ -5641,9 +5648,8 @@ sub match_dest_net( $;$ ) {
if ( $3 ) {
require_capability 'NFACCT_MATCH', "An nfacct object list ($3)", 's';
for ( my @objects = split_list $3, 'nfacct' ) {
fatal_error "Invalid nfacct object name ($_)" unless /^[\w%&@~]+$/;
validate_nfobject( $_ );
$result .= "-m nfacct --nfacct-name $_ ";
$nfobjects{$_} = 1;
}
}
@ -5704,9 +5710,8 @@ sub imatch_dest_net( $;$ ) {
if ( $3 ) {
require_capability 'NFACCT_MATCH', "An nfacct object list ($3)", 's';
for ( my @objects = split_list $3, 'nfacct' ) {
fatal_error "Invalid nfacct object name ($_)" unless /^[\w%&@~]+$/;
validate_nfobject( $_ );
push( @result, ( nfacct => "--nfacct-name $_" ) );
$nfobjects{$_} = 1;
}
}
@ -5725,9 +5730,8 @@ sub imatch_dest_net( $;$ ) {
if ( $3 ) {
require_capability 'NFACCT_MATCH', "An nfacct object list ($3)", 's';
for ( my @objects = split_list $3, 'nfacct' ) {
fatal_error "Invalid nfacct object name ($_)" unless /^[\w%&@~]+$/;
validate_nfobject( $_ );
push( @result, ( nfacct => "--nfacct-name $_" ) );
$nfobjects{$_} = 1;
}
}
}

2
Shorewall/Perl/Shorewall/Config.pm
View File

@ -2853,7 +2853,7 @@ sub embedded_perl( $ ) {
# Return inline matches
#
sub get_inline_matches() {
$inline_matches;
"$inline_matches ";
}
#

4
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -2097,14 +2097,14 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
if ( $basictarget eq 'INLINE' ) {
my $inline_matches = get_inline_matches;
if ( $inline_matches =~ /^(.*\s+)-j\s+(.+)$/ ) {
if ( $inline_matches =~ /^(.*\s+)-j\s+(.+) $/ ) {
$raw_matches .= $1;
$action = $2;
my ( $target ) = split ' ', $action;
fatal_error "Unknown jump target ($action)" unless $targets{$target};
fatal_error "INLINE may not have a parameter when '-j' is specified in the free-form area" if $param ne '';
} else {
$raw_matches .= "$inline_matches ";
$raw_matches .= $inline_matches;
if ( $param eq '' ) {
$action = $loglevel ? 'LOG' : '';