[Bug 1191] New: Empty parameters generate errors on iptables-restore, even when saved by iptables-save

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1191

            Bug ID: 1191
           Summary: Empty parameters generate errors on iptables-restore,
                    even when saved by iptables-save
           Product: iptables
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: iptables-restore
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: valeriug at gmail.com

Empty comments "" are allowed and working in iptables. iptables-save saves them
correctly, but iptables-restore does not work when it encounters them.

The problem comes from iptables-restore.c function add_param_to_argv(char
*parsestart) which skips the parameters "".

Here is a example how to reproduce the problem:
- add a rule with an empty comment to running iptables
- run iptables-save
- run iptables-restore on the file saved by iptables-save

[root at ip-10-1-1-93 ~]# iptables -t filter -A INPUT -s 1.2.3.4/32 -d 1.2.3.5/32
-m comment --comment "" -j ACCEPT

[root at ip-10-1-1-93 ~]# iptables-save | tee /tmp/ipt-save
# Generated by iptables-save v1.4.21 on Tue Oct 17 07:31:53 2017
*nat
:PREROUTING ACCEPT [270:31944]
:INPUT ACCEPT [266:31784]
:OUTPUT ACCEPT [24586:1567483]
:POSTROUTING ACCEPT [24586:1567483]
COMMIT
# Completed on Tue Oct 17 07:31:53 2017
# Generated by iptables-save v1.4.21 on Tue Oct 17 07:31:53 2017
*filter
:INPUT ACCEPT [149:11200]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [79:7842]
-A INPUT -s 1.2.3.4/32 -d 1.2.3.5/32 -m comment --comment "" -j ACCEPT
COMMIT
# Completed on Tue Oct 17 07:31:53 2017

[root at ip-10-1-1-93 ~]# iptables-restore /tmp/ipt-save
Bad argument `ACCEPT'
Error occurred at line: 14
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[root at ip-10-1-1-93 ~]#

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20171017/1e727c5c/attachment.html>