[netfilter-cvslog] r7303 - in trunk/iptables: . extensions include

[kaber at trash.net]

Author: kaber at trash.net
Date: 2008-01-29 14:44:34 +0100 (Tue, 29 Jan 2008)
New Revision: 7303

Modified:
   trunk/iptables/extensions/libipt_LOG.c
   trunk/iptables/extensions/libipt_ULOG.c
   trunk/iptables/extensions/libxt_NFLOG.c
   trunk/iptables/extensions/libxt_helper.c
   trunk/iptables/include/xtables.h
   trunk/iptables/xtables.c
Log:
[PATCH]: escape strings

Max Kellermann <max at duempel.org>


Modified: trunk/iptables/extensions/libipt_LOG.c
===================================================================
--- trunk/iptables/extensions/libipt_LOG.c	2008-01-29 13:43:35 UTC (rev 7302)
+++ trunk/iptables/extensions/libipt_LOG.c	2008-01-29 13:44:34 UTC (rev 7303)
@@ -240,8 +240,10 @@
 	const struct ipt_log_info *loginfo
 		= (const struct ipt_log_info *)target->data;
 
-	if (strcmp(loginfo->prefix, "") != 0)
-		printf("--log-prefix \"%s\" ", loginfo->prefix);
+	if (strcmp(loginfo->prefix, "") != 0) {
+		printf("--log-prefix ");
+		save_string(loginfo->prefix);
+	}
 
 	if (loginfo->level != LOG_DEFAULT_LEVEL)
 		printf("--log-level %d ", loginfo->level);

Modified: trunk/iptables/extensions/libipt_ULOG.c
===================================================================
--- trunk/iptables/extensions/libipt_ULOG.c	2008-01-29 13:43:35 UTC (rev 7302)
+++ trunk/iptables/extensions/libipt_ULOG.c	2008-01-29 13:44:34 UTC (rev 7303)
@@ -155,8 +155,10 @@
 	const struct ipt_ulog_info *loginfo
 	    = (const struct ipt_ulog_info *) target->data;
 
-	if (strcmp(loginfo->prefix, "") != 0)
-		printf("--ulog-prefix \"%s\" ", loginfo->prefix);
+	if (strcmp(loginfo->prefix, "") != 0) {
+		fputs("--ulog-prefix ", stdout);
+		save_string(loginfo->prefix);
+	}
 
 	if (loginfo->nl_group != ULOG_DEFAULT_NLGROUP) {
 		printf("--ulog-nlgroup ");

Modified: trunk/iptables/extensions/libxt_NFLOG.c
===================================================================
--- trunk/iptables/extensions/libxt_NFLOG.c	2008-01-29 13:43:35 UTC (rev 7302)
+++ trunk/iptables/extensions/libxt_NFLOG.c	2008-01-29 13:44:34 UTC (rev 7303)
@@ -112,8 +112,10 @@
 
 static void nflog_print(const struct xt_nflog_info *info, char *prefix)
 {
-	if (info->prefix[0] != '\0')
-		printf("%snflog-prefix \"%s\" ", prefix, info->prefix);
+	if (info->prefix[0] != '\0') {
+		printf("%snflog-prefix ", prefix);
+		save_string(info->prefix);
+	}
 	if (info->group)
 		printf("%snflog-group %u ", prefix, info->group);
 	if (info->len)

Modified: trunk/iptables/extensions/libxt_helper.c
===================================================================
--- trunk/iptables/extensions/libxt_helper.c	2008-01-29 13:43:35 UTC (rev 7302)
+++ trunk/iptables/extensions/libxt_helper.c	2008-01-29 13:44:34 UTC (rev 7303)
@@ -72,7 +72,8 @@
 {
 	struct xt_helper_info *info = (struct xt_helper_info *)match->data;
 
-	printf("%s--helper \"%s\" ",info->invert ? "! " : "", info->name);
+	printf("%s--helper ",info->invert ? "! " : "");
+	save_string(info->name);
 }
 
 static struct xtables_match helper_match = {

Modified: trunk/iptables/include/xtables.h
===================================================================
--- trunk/iptables/include/xtables.h	2008-01-29 13:43:35 UTC (rev 7302)
+++ trunk/iptables/include/xtables.h	2008-01-29 13:44:34 UTC (rev 7303)
@@ -251,6 +251,12 @@
 extern void ip6parse_hostnetworkmask(const char *, struct in6_addr **,
 	struct in6_addr *, unsigned int *);
 
+/**
+ * Print the specified value to standard output, quoting dangerous
+ * characters if required.
+ */
+extern void save_string(const char *value);
+
 #ifdef NO_SHARED_LIBS
 #	ifdef _INIT
 #		undef _init

Modified: trunk/iptables/xtables.c
===================================================================
--- trunk/iptables/xtables.c	2008-01-29 13:43:35 UTC (rev 7302)
+++ trunk/iptables/xtables.c	2008-01-29 13:44:34 UTC (rev 7303)
@@ -1168,3 +1168,40 @@
 			}
 	}
 }
+
+void save_string(const char *value)
+{
+	static const char no_quote_chars[] = "_-0123456789"
+		"abcdefghijklmnopqrstuvwxyz"
+		"ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+	static const char escape_chars[] = "\"\\'";
+	size_t length;
+	const char *p;
+
+	length = strcspn(value, no_quote_chars);
+	if (length > 0 && value[length] == 0) {
+		/* no quoting required */
+		fputs(value, stdout);
+		putchar(' ');
+	} else {
+		/* there is at least one dangerous character in the
+		   value, which we have to quote.  Write double quotes
+		   around the value and escape special characters with
+		   a backslash */
+		putchar('"');
+
+		for (p = strpbrk(value, escape_chars); p != NULL;
+		     p = strpbrk(value, escape_chars)) {
+			if (p > value)
+				fwrite(value, 1, p - value, stdout);
+			putchar('\\');
+			putchar(*p);
+			value = p + 1;
+		}
+
+		/* print the rest and finish the double quoted
+		   string */
+		fputs(value, stdout);
+		printf("\" ");
+	}
+}