iptables: abort on empty interface specification

Fiedler Roman brings to attention that if, in a faulty script,
"$some_variable" expands to an empty string, iptables should probably
catch this most likely undesired invocation. If no/all interfaces were
really desired, one can either omit -i completely, or use -i +.

References: http://marc.info/?l=netfilter&m=129439862903487&w=2
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

diff --git a/ip6tables.c b/ip6tables.c
index 84908ebf679cfafa25277e385a0587526ec8f84d..b8449f6e6a47b93b190d69264900170e3d2f4865 100644 (file)
--- a/ip6tables.c
+++ b/ip6tables.c
@@ -1573,6 +1573,10 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand
 
 
                case 'i':
+                       if (*optarg == '\0')
+                               xtables_error(PARAMETER_PROBLEM,
+                                       "Empty interface is likely to be "
+                                       "undesired");
                        xtables_check_inverse(optarg, &invert, &optind, argc, argv);
                        set_option(&options, OPT_VIANAMEIN, &fw.ipv6.invflags,
                                   invert);
@@ -1582,6 +1586,10 @@ int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **hand
                        break;
 
                case 'o':
+                       if (*optarg == '\0')
+                               xtables_error(PARAMETER_PROBLEM,
+                                       "Empty interface is likely to be "
+                                       "undesired");
                        xtables_check_inverse(optarg, &invert, &optind, argc, argv);
                        set_option(&options, OPT_VIANAMEOUT, &fw.ipv6.invflags,
                                   invert);

diff --git a/iptables.c b/iptables.c
index 6549c1dd63f2e2b6c2dd1314bf4580862719c44c..e0efbf1b7165f4f95e4989188de0e079e6f42fb9 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -1590,6 +1590,10 @@ int do_command(int argc, char *argv[], char **table, struct iptc_handle **handle
 
 
                case 'i':
+                       if (*optarg == '\0')
+                               xtables_error(PARAMETER_PROBLEM,
+                                       "Empty interface is likely to be "
+                                       "undesired");
                        xtables_check_inverse(optarg, &invert, &optind, argc, argv);
                        set_option(&options, OPT_VIANAMEIN, &fw.ip.invflags,
                                   invert);
@@ -1599,6 +1603,10 @@ int do_command(int argc, char *argv[], char **table, struct iptc_handle **handle
                        break;
 
                case 'o':
+                       if (*optarg == '\0')
+                               xtables_error(PARAMETER_PROBLEM,
+                                       "Empty interface is likely to be "
+                                       "undesired");
                        xtables_check_inverse(optarg, &invert, &optind, argc, argv);
                        set_option(&options, OPT_VIANAMEOUT, &fw.ip.invflags,
                                   invert);