iptables: iptables-xml: Fix various parsing bugs

There are two bugs in iptables-xml do_rule_part parsing corrected by this patch:

1) Ignore "-A <chain>" instead of just "-A"
2) When checking to see if we need a <match> tag, inversion needs to be taken
   into account

This closes netfilter bugzilla #679.

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/iptables-xml.c b/iptables/iptables-xml.c
index 4b12bd466dae3b06800d2636a0af4d0e54443f4f..e272ef9136f8374e7f47e3844a9c00c11d572b1c 100644 (file)
--- a/iptables/iptables-xml.c
+++ b/iptables/iptables-xml.c
@@ -367,7 +367,8 @@ static void
 do_rule_part(char *leveltag1, char *leveltag2, int part, int argc,
             char *argv[], int argvattr[])
 {
-       int arg = 1;            // ignore leading -A
+       int i;
+       int arg = 2;            // ignore leading -A <chain>
        char invert_next = 0;
        char *spacer = "";      // space when needed to assemble arguments
        char *level1 = NULL;
@@ -399,11 +400,17 @@ do_rule_part(char *leveltag1, char *leveltag2, int part, int argc,
                        arg++;
        }
 
-       /* Before we start, if the first arg is -[^-] and not -m or -j or -g 
-          then start a dummy <match> tag for old style built-in matches.  
-          We would do this in any case, but no need if it would be empty */
-       if (arg < argc && argv[arg][0] == '-' && !isTarget(argv[arg])
-           && strcmp(argv[arg], "-m") != 0) {
+       /* Before we start, if the first arg is -[^-] and not -m or -j or -g
+        * then start a dummy <match> tag for old style built-in matches.
+        * We would do this in any case, but no need if it would be empty.
+        * In the case of negation, we need to look at arg+1
+        */
+       if (arg < argc && strcmp(argv[arg], "!") == 0)
+               i = arg + 1;
+       else
+               i = arg;
+       if (i < argc && argv[i][0] == '-' && !isTarget(argv[i])
+           && strcmp(argv[i], "-m") != 0) {
                OPEN_LEVEL(1, "match");
                printf(">\n");
        }