Fix 'iptables -p !' bug (segfault when `!' used without argument)

diff --git a/extensions/libip6t_LOG.c b/extensions/libip6t_LOG.c
index 39d938a71eac58f98115b3a65e1df8662a92d7dc..529720f8e140994a9c60241c1b11d1804fbc38a7 100644 (file)
--- a/extensions/libip6t_LOG.c
+++ b/extensions/libip6t_LOG.c
@@ -114,7 +114,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Can't specify --log-level twice");
 
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --log-level");
 
@@ -127,7 +127,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Can't specify --log-prefix twice");
 
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --log-prefix");
 

diff --git a/extensions/libip6t_REJECT.c b/extensions/libip6t_REJECT.c
index ab8595d9d69b8599afce98617d2315b2ac68816f..a145f44990b4e404522f50c6ceb996be0294fdfb 100644 (file)
--- a/extensions/libip6t_REJECT.c
+++ b/extensions/libip6t_REJECT.c
@@ -97,7 +97,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch(c) {
        case '1':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --reject-with");
                for (i = 0; i < limit; i++) {

diff --git a/extensions/libip6t_icmpv6.c b/extensions/libip6t_icmpv6.c
index 4185cada16a2c0ef9430e8f4b1fc37dd8355d67d..97027da15275bb79a8307f9369528f37b5b20383 100644 (file)
--- a/extensions/libip6t_icmpv6.c
+++ b/extensions/libip6t_icmpv6.c
@@ -168,8 +168,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                *nfcache |= parse_icmpv6(argv[optind-1],
                                       &icmpv6info->type,
                                       icmpv6info->code);

diff --git a/extensions/libip6t_ipv6header.c b/extensions/libip6t_ipv6header.c
index b1fcc04b802c552acef7ab2933481869344a9d71..6e4986de543badadeda03aa178a638efc588dd56 100644 (file)
--- a/extensions/libip6t_ipv6header.c
+++ b/extensions/libip6t_ipv6header.c
@@ -200,8 +200,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                                exit_error(PARAMETER_PROBLEM,
                                        "Only one `--header' allowed");
 
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, 0);
 
                        if (! (info->matchflags = parse_header(argv[optind-1])) )
                                exit_error(PARAMETER_PROBLEM, "ip6t_ipv6header: cannot parse header names");

diff --git a/extensions/libip6t_length.c b/extensions/libip6t_length.c
index 71075ca0a42862a6e6ef119dcfc03fd9cd8e64b7..fe65115fe00d3645fb3b7fdad9c117b651a7262c 100644 (file)
--- a/extensions/libip6t_length.c
+++ b/extensions/libip6t_length.c
@@ -87,8 +87,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                                exit_error(PARAMETER_PROBLEM,
                                           "length: `--length' may only be "
                                           "specified once");
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, 0);
                        parse_lengths(argv[optind-1], info);
                        if (invert)
                                info->invert = 1;

diff --git a/extensions/libip6t_limit.c b/extensions/libip6t_limit.c
index 837b0fe2063c5bbf53e5c7d2506160bc05693f1c..4a0dc08c356226efb355009dd7834ad2848ad070 100644 (file)
--- a/extensions/libip6t_limit.c
+++ b/extensions/libip6t_limit.c
@@ -1,8 +1,9 @@
 /* Shared library add-on to iptables to add limit support.
  *
  * Jérôme de Vivie   <devivie@info.enserb.u-bordeaux.fr>
- * Hervé Eychenne   <eychenne@info.enserb.u-bordeaux.fr>
+ * Hervé Eychenne    <rv@wallfire.org>
  */
+
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -102,7 +103,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch(c) {
        case '%':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --limit");
                if (!parse_rate(optarg, &r->avg))
@@ -111,7 +112,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '$':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --limit-burst");
 

diff --git a/extensions/libip6t_mac.c b/extensions/libip6t_mac.c
index e4c434548140036834d9e56ba6293dac78f94d4a..64c62f235ae4e6986299fabbb3a45f5859b9c5e2 100644 (file)
--- a/extensions/libip6t_mac.c
+++ b/extensions/libip6t_mac.c
@@ -72,8 +72,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_mac(argv[optind-1], macinfo);
                if (invert)
                        macinfo->invert = 1;

diff --git a/extensions/libip6t_mark.c b/extensions/libip6t_mark.c
index b344bb63b6743c1027dd1c7b4c2b1b8bd3efdd73..7a05d0380562b784c82d19edbe6700255c15f4cd 100644 (file)
--- a/extensions/libip6t_mark.c
+++ b/extensions/libip6t_mark.c
@@ -45,8 +45,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
        switch (c) {
                char *end;
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                markinfo->mark = strtoul(optarg, &end, 0);
                if (*end == '/') {
                        markinfo->mask = strtoul(end+1, &end, 0);

diff --git a/extensions/libip6t_owner.c b/extensions/libip6t_owner.c
index 4eed251335d2abfd8ae8713593897d28baf4c509..8b511d9ebd04670b037e1cc5951d663f1a73260e 100644 (file)
--- a/extensions/libip6t_owner.c
+++ b/extensions/libip6t_owner.c
@@ -55,8 +55,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                struct passwd *pwd;
                struct group *grp;
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                if ((pwd = getpwnam(optarg)))
                        ownerinfo->uid = pwd->pw_uid;
@@ -72,8 +71,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '2':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                if ((grp = getgrnam(optarg)))
                        ownerinfo->gid = grp->gr_gid;
                else {
@@ -88,8 +86,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '3':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                ownerinfo->pid = strtoul(optarg, &end, 0);
                if (*end != '\0' || end == optarg)
                        exit_error(PARAMETER_PROBLEM, "Bad OWNER PID value `%s'", optarg);
@@ -100,8 +97,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '4':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                ownerinfo->sid = strtoul(optarg, &end, 0);
                if (*end != '\0' || end == optarg)
                        exit_error(PARAMETER_PROBLEM, "Bad OWNER SID value `%s'", optarg);

diff --git a/extensions/libip6t_tcp.c b/extensions/libip6t_tcp.c
index f03f072aa6aaeaf687f3a568d03fad35b0d185c3..d158a8c2005d363b84c6caeb044d7a892142b39e 100644 (file)
--- a/extensions/libip6t_tcp.c
+++ b/extensions/libip6t_tcp.c
@@ -178,8 +178,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & TCP_SRC_PORTS)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--source-port' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_tcp_ports(argv[optind-1], tcpinfo->spts);
                if (invert)
                        tcpinfo->invflags |= IP6T_TCP_INV_SRCPT;
@@ -191,8 +190,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & TCP_DST_PORTS)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--destination-port' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_tcp_ports(argv[optind-1], tcpinfo->dpts);
                if (invert)
                        tcpinfo->invflags |= IP6T_TCP_INV_DSTPT;
@@ -215,8 +213,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one of `--syn' or `--tcp-flags' "
                                   " allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                if (!argv[optind]
                    || argv[optind][0] == '-' || argv[optind][0] == '!')
@@ -232,8 +229,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & TCP_OPTION)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--tcp-option' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_tcp_option(argv[optind-1], &tcpinfo->option);
                if (invert)
                        tcpinfo->invflags |= IP6T_TCP_INV_OPTION;

diff --git a/extensions/libip6t_udp.c b/extensions/libip6t_udp.c
index 441c81479c9f0b6938ee691098f478dd75812b4b..5378e592495aec266a68a988cafd3048e106f901 100644 (file)
--- a/extensions/libip6t_udp.c
+++ b/extensions/libip6t_udp.c
@@ -100,8 +100,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & UDP_SRC_PORTS)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--source-port' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_udp_ports(argv[optind-1], udpinfo->spts);
                if (invert)
                        udpinfo->invflags |= IP6T_UDP_INV_SRCPT;
@@ -113,8 +112,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & UDP_DST_PORTS)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--destination-port' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_udp_ports(argv[optind-1], udpinfo->dpts);
                if (invert)
                        udpinfo->invflags |= IP6T_UDP_INV_DSTPT;

diff --git a/extensions/libipt_BALANCE.c b/extensions/libipt_BALANCE.c
index 75f4cda8e55c06b93188ee2c26312a283abf3ed9..78d5d2d704f301dc8408490a46ae0e2dccbaca6d 100644 (file)
--- a/extensions/libipt_BALANCE.c
+++ b/extensions/libipt_BALANCE.c
@@ -77,7 +77,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --to-destination");
 

diff --git a/extensions/libipt_DNAT.c b/extensions/libipt_DNAT.c
index 3e466ae31d19803c21adbe847b9b69a50fa79ac1..279f76e8c8eda1672cae3054495ea705d841e78b 100644 (file)
--- a/extensions/libipt_DNAT.c
+++ b/extensions/libipt_DNAT.c
@@ -153,7 +153,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --to-destination");
 

diff --git a/extensions/libipt_LOG.c b/extensions/libipt_LOG.c
index 68a9f652a4d054daa47b9b81b9fcd7493e96dc95..1445f08a7b751b1454e2e47a133e4f6eeb3b6498 100644 (file)
--- a/extensions/libipt_LOG.c
+++ b/extensions/libipt_LOG.c
@@ -114,7 +114,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Can't specify --log-level twice");
 
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --log-level");
 
@@ -127,7 +127,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Can't specify --log-prefix twice");
 
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --log-prefix");
 

diff --git a/extensions/libipt_MASQUERADE.c b/extensions/libipt_MASQUERADE.c
index 0eecba5cf88bc2ac360f942b0a49a0d5585195ad..a45285a921e1e730f423a3048608490f592351ed 100644 (file)
--- a/extensions/libipt_MASQUERADE.c
+++ b/extensions/libipt_MASQUERADE.c
@@ -94,7 +94,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Need TCP or UDP with port specification");
 
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --to-ports");
 

diff --git a/extensions/libipt_NETLINK.c b/extensions/libipt_NETLINK.c
index 104e642709ad36daff2c9c6703c1f4ca738be716..7855d997212d8702f3b31cfd70772de434f4e8df 100644 (file)
--- a/extensions/libipt_NETLINK.c
+++ b/extensions/libipt_NETLINK.c
@@ -48,7 +48,7 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
                                exit_error(PARAMETER_PROBLEM,
                                "Can't specify --nldrop twice");
 
-                       if ( check_inverse(optarg, &invert) ) {
+                       if ( check_inverse(optarg, &invert, NULL, 0) ) {
                                MASK_UNSET(nld->flags, USE_DROP);
                        } else {
                                MASK_SET(nld->flags, USE_DROP);
@@ -62,7 +62,7 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
                                exit_error(PARAMETER_PROBLEM,
                                "Can't specify --nlmark twice");
 
-                       if (check_inverse(optarg, &invert)) {
+                       if (check_inverse(optarg, &invert, NULL, 0)) {
                                MASK_UNSET(nld->flags, USE_MARK);
                        }else{
                                MASK_SET(nld->flags, USE_MARK);
@@ -81,7 +81,7 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
                                "--nlsize must be larger than zero");
                        
 
-                       if (check_inverse(optarg, &invert)) {
+                       if (check_inverse(optarg, &invert, NULL, 0)) {
                                MASK_UNSET(nld->flags, USE_SIZE);
                        }else{
                                MASK_SET(nld->flags, USE_SIZE);

diff --git a/extensions/libipt_NETMAP.c b/extensions/libipt_NETMAP.c
index 947ca8d453d29ebc59a999c62140eceb59c20c3f..91241574493bcb580c333cfeb899282ef62e5b00 100644 (file)
--- a/extensions/libipt_NETMAP.c
+++ b/extensions/libipt_NETMAP.c
@@ -128,7 +128,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --%s", opts[0].name);
 

diff --git a/extensions/libipt_REDIRECT.c b/extensions/libipt_REDIRECT.c
index 02afacf981bfee7a4e6852f2a5ae13f2876db272..ca029c8670d8f0307b3811824069db4955316b39 100644 (file)
--- a/extensions/libipt_REDIRECT.c
+++ b/extensions/libipt_REDIRECT.c
@@ -94,7 +94,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Need TCP or UDP with port specification");
 
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --to-ports");
 

diff --git a/extensions/libipt_REJECT.c b/extensions/libipt_REJECT.c
index 431695820d6c28311e2dabe8dc9dec2e2863fc14..2403befc5445bad9a2f7118a8e100d0b64b1c5a8 100644 (file)
--- a/extensions/libipt_REJECT.c
+++ b/extensions/libipt_REJECT.c
@@ -97,7 +97,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch(c) {
        case '1':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --reject-with");
                for (i = 0; i < limit; i++) {

diff --git a/extensions/libipt_SAME.c b/extensions/libipt_SAME.c
index 59ef604b197e521f4155d8fb0283719dcda12354..37c75d8947f5d1297ad56ca1e643195c3bf58867 100644 (file)
--- a/extensions/libipt_SAME.c
+++ b/extensions/libipt_SAME.c
@@ -98,7 +98,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                                   "Too many ranges specified, maximum "
                                   "is %i ranges.\n",
                                   IPT_SAME_MAX_RANGE);
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --to");
 

diff --git a/extensions/libipt_SNAT.c b/extensions/libipt_SNAT.c
index 1af0d5eff35709f4d8fcad54cbef7fea13b011f2..9493a149c8398a12d78408ca558b6f547ba9eb8f 100644 (file)
--- a/extensions/libipt_SNAT.c
+++ b/extensions/libipt_SNAT.c
@@ -153,7 +153,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --to-source");
 

diff --git a/extensions/libipt_TTL.c b/extensions/libipt_TTL.c
index 0dc73513c61df1a0cbb56c09cec9f08a4bc50620..e4d56b362da3acfe8adf8040d6317e86a469a082 100644 (file)
--- a/extensions/libipt_TTL.c
+++ b/extensions/libipt_TTL.c
@@ -1,7 +1,7 @@
 /* Shared library add-on to iptables for the TTL target
  * (C) 2000 by Harald Welte <laforge@gnumonks.org>
  *
- * $Id: libipt_TTL.c,v 1.3 2000/11/13 11:16:08 laforge Exp $
+ * $Id: libipt_TTL.c,v 1.4 2002/02/25 11:25:41 laforge Exp $
  *
  * This program is distributed under the terms of GNU GPL
  */
@@ -46,7 +46,7 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
                exit_error(PARAMETER_PROBLEM, 
                                "TTL: You must specify a value");
 
-       if (check_inverse(optarg, &invert))
+       if (check_inverse(optarg, &invert, NULL, 0))
                exit_error(PARAMETER_PROBLEM,
                                "TTL: unexpected `!'");
        

diff --git a/extensions/libipt_ULOG.c b/extensions/libipt_ULOG.c
index 5de8ee0e01069b6151969f7665ec884d4de8978b..6a9c3420b12c757f8f8b0030c4a7287050b00a58 100644 (file)
--- a/extensions/libipt_ULOG.c
+++ b/extensions/libipt_ULOG.c
@@ -87,7 +87,7 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Can't specify --ulog-nlgroup twice");
 
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --ulog-nlgroup");
                group_d = atoi(optarg);
@@ -105,7 +105,7 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Can't specify --ulog-prefix twice");
 
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --ulog-prefix");
 

diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c
index 0473760fada7528663354b24e9d355ea1ab81508..86863266beaa089299039316ada2946110defc98 100644 (file)
--- a/extensions/libipt_ah.c
+++ b/extensions/libipt_ah.c
@@ -92,8 +92,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & AH_SPI)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--spi' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_ah_spis(argv[optind-1], ahinfo->spis);
                if (invert)
                        ahinfo->invflags |= IPT_AH_INV_SPI;

diff --git a/extensions/libipt_connlimit.c b/extensions/libipt_connlimit.c
index 19928ac2e77d5b9e221b26e40306e519af722377..a9a0f378fb2c08b224619f90408887c735c8df77 100644 (file)
--- a/extensions/libipt_connlimit.c
+++ b/extensions/libipt_connlimit.c
@@ -51,8 +51,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                info->limit = atoi(argv[optind-1]);
                info->inverse = invert;
                *flags |= 1;

diff --git a/extensions/libipt_connmark.c b/extensions/libipt_connmark.c
index e71d96299718084518e756fa4da22da5176a21ba..005050fa8d134b60e8c9119bfc9beb99c88cac99 100644 (file)
--- a/extensions/libipt_connmark.c
+++ b/extensions/libipt_connmark.c
@@ -45,8 +45,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
        switch (c) {
                char *end;
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                markinfo->mark = strtoul(optarg, &end, 0);
                if (*end == '/') {
                        markinfo->mask = strtoul(end+1, &end, 0);

diff --git a/extensions/libipt_conntrack.c b/extensions/libipt_conntrack.c
index 9b63939172cfa1bbbde71ec32aa669357f8818fe..b15ade0ce28336917c0fb77860b64f9e0d091a13 100644 (file)
--- a/extensions/libipt_conntrack.c
+++ b/extensions/libipt_conntrack.c
@@ -179,8 +179,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                parse_states(argv[optind-1], sinfo);
                if (invert) {
@@ -190,8 +189,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '2':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optdind, 0);
 
                if(invert)
                        sinfo->invflags |= IPT_CONNTRACK_PROTO;
@@ -212,8 +210,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '3':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 9);
 
                if (invert)
                        sinfo->invflags |= IPT_CONNTRACK_ORIGSRC;
@@ -233,8 +230,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '4':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                if (invert)
                        sinfo->invflags |= IPT_CONNTRACK_ORIGDST;
@@ -254,8 +250,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '5':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                if (invert)
                        sinfo->invflags |= IPT_CONNTRACK_REPLSRC;
@@ -275,8 +270,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '6':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                if (invert)
                        sinfo->invflags |= IPT_CONNTRACK_REPLDST;
@@ -296,8 +290,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '7':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                parse_statuses(argv[optind-1], sinfo);
                if (invert) {
@@ -307,8 +300,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '8':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                parse_expires(argv[optind-1], sinfo);
                if (invert) {

diff --git a/extensions/libipt_esp.c b/extensions/libipt_esp.c
index 07d251566816a16c174cf440c448e4d3c0cbbb83..8890ff7fad0f2c9ce71a623fb2c12c36d66ab0ef 100644 (file)
--- a/extensions/libipt_esp.c
+++ b/extensions/libipt_esp.c
@@ -92,8 +92,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & ESP_SPI)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--spi' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_esp_spis(argv[optind-1], espinfo->spis);
                if (invert)
                        espinfo->invflags |= IPT_ESP_INV_SPI;

diff --git a/extensions/libipt_helper.c b/extensions/libipt_helper.c
index ddb42eea94abe28b6eb4f68b3ff7b3d642bba20e..92ade9333c9c37f33fa9a56844d7d5cc0edbcf08 100644 (file)
--- a/extensions/libipt_helper.c
+++ b/extensions/libipt_helper.c
@@ -44,8 +44,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &invert, 0);
                strncpy(info->name, optarg, 29);
                if (invert)
                        info->invert = 1;

diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
index 8d2d85d5ca46d6ed1ff9ef5e0ffc082e933bce7d..98098fa45a6a46e3991cb8428d47ffea7e46801c 100644 (file)
--- a/extensions/libipt_icmp.c
+++ b/extensions/libipt_icmp.c
@@ -183,8 +183,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                *nfcache |= parse_icmp(argv[optind-1],
                                       &icmpinfo->type,
                                       icmpinfo->code);

diff --git a/extensions/libipt_length.c b/extensions/libipt_length.c
index 00326c4b7fe5644e6c93c08bdfa08c36e9bfef02..cd5a6a8768adeaddd2efcf564ca8609a8b8c7999 100644 (file)
--- a/extensions/libipt_length.c
+++ b/extensions/libipt_length.c
@@ -85,8 +85,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                                exit_error(PARAMETER_PROBLEM,
                                           "length: `--length' may only be "
                                           "specified once");
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, 0);
                        parse_lengths(argv[optind-1], info);
                        if (invert)
                                info->invert = 1;

diff --git a/extensions/libipt_limit.c b/extensions/libipt_limit.c
index 73f9b37a75edc306ba02a275d543c0a6181db742..28395472c0301e3eea07f7d92b1e231e772291b8 100644 (file)
--- a/extensions/libipt_limit.c
+++ b/extensions/libipt_limit.c
@@ -1,8 +1,9 @@
 /* Shared library add-on to iptables to add limit support.
  *
  * Jérôme de Vivie   <devivie@info.enserb.u-bordeaux.fr>
- * Hervé Eychenne   <eychenne@info.enserb.u-bordeaux.fr>
+ * Hervé Eychenne    <rv@wallfire.org>
  */
+
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -102,7 +103,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch(c) {
        case '%':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --limit");
                if (!parse_rate(optarg, &r->avg))
@@ -111,7 +112,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '$':
-               if (check_inverse(optarg, &invert))
+               if (check_inverse(optarg, &invert, NULL, 0))
                        exit_error(PARAMETER_PROBLEM,
                                   "Unexpected `!' after --limit-burst");
 

diff --git a/extensions/libipt_mac.c b/extensions/libipt_mac.c
index 1b088a854f35b0416e9bdbaa713e797c6328323e..5779e8b649384cb188ce3818a96f5e638f8aef4c 100644 (file)
--- a/extensions/libipt_mac.c
+++ b/extensions/libipt_mac.c
@@ -72,8 +72,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_mac(argv[optind-1], macinfo);
                if (invert)
                        macinfo->invert = 1;

diff --git a/extensions/libipt_mark.c b/extensions/libipt_mark.c
index 001635a663451322f2fa6ec5766bfc4abc8944d5..1c86fd7ab8bd8cf0bfc4f5f3ed8a37fdad58beb8 100644 (file)
--- a/extensions/libipt_mark.c
+++ b/extensions/libipt_mark.c
@@ -45,8 +45,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
        switch (c) {
                char *end;
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                markinfo->mark = strtoul(optarg, &end, 0);
                if (*end == '/') {
                        markinfo->mask = strtoul(end+1, &end, 0);

diff --git a/extensions/libipt_owner.c b/extensions/libipt_owner.c
index 30ee0c110eac04419e1ad724357f4052f939cad0..9663122091d62c3223578fc994cb502a19c3531e 100644 (file)
--- a/extensions/libipt_owner.c
+++ b/extensions/libipt_owner.c
@@ -61,9 +61,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                struct passwd *pwd;
                struct group *grp;
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
-
+               check_inverse(optarg, &invert, &optind, 0);
                if ((pwd = getpwnam(optarg)))
                        ownerinfo->uid = pwd->pw_uid;
                else {
@@ -78,8 +76,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '2':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                if ((grp = getgrnam(optarg)))
                        ownerinfo->gid = grp->gr_gid;
                else {
@@ -94,8 +91,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '3':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                ownerinfo->pid = strtoul(optarg, &end, 0);
                if (*end != '\0' || end == optarg)
                        exit_error(PARAMETER_PROBLEM, "Bad OWNER PID value `%s'", optarg);
@@ -106,8 +102,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                break;
 
        case '4':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                ownerinfo->sid = strtoul(optarg, &end, 0);
                if (*end != '\0' || end == optarg)
                        exit_error(PARAMETER_PROBLEM, "Bad OWNER SID value `%s'", optarg);
@@ -119,8 +114,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
 #ifdef IPT_OWNER_COMM
        case '5':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                if(strlen(optarg) > sizeof(ownerinfo->comm))
                        exit_error(PARAMETER_PROBLEM, "OWNER CMD `%s' too long, max %d characters", optarg, sizeof(ownerinfo->comm));
 

diff --git a/extensions/libipt_pkttype.c b/extensions/libipt_pkttype.c
index 04a43db75d0f58ffbbf9777b22a64d7ec7118bc2..a0c74b8d82d408d13de550aaf84ba061aefd6ab2 100644 (file)
--- a/extensions/libipt_pkttype.c
+++ b/extensions/libipt_pkttype.c
@@ -100,8 +100,7 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
        switch(c)
        {
                case '1':
-                       if(check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, 0);
                        parse_pkttype(argv[optind-1], info);
                        if(invert)
                                info->invert=1;

diff --git a/extensions/libipt_pool.c b/extensions/libipt_pool.c
index 3fec4634c17bbb85746204bcb59346d931caacf8..4e54f455e260e1b732f2a1d52d917a4062cb80e5 100644 (file)
--- a/extensions/libipt_pool.c
+++ b/extensions/libipt_pool.c
@@ -59,13 +59,13 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert)) optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                info->src = ip_pool_get_index(argv[optind-1]);
                if (invert) info->flags |= IPT_POOL_INV_SRC;
                *flags = 1;
                break;
        case '2':
-               if (check_inverse(optarg, &invert)) optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                info->dst = ip_pool_get_index(argv[optind-1]);
                if (invert) info->flags |= IPT_POOL_INV_DST;
                *flags = 1;

diff --git a/extensions/libipt_quota.c b/extensions/libipt_quota.c
index 28e16e6140da27e080528c2de595715eb3814e6a..d95b8a1955eb5e1f74703ef91cd70b9d8a119f90 100644 (file)
--- a/extensions/libipt_quota.c
+++ b/extensions/libipt_quota.c
@@ -74,7 +74,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
         switch (c) {
         case '1':
-                if (check_inverse(optarg, &invert))
+                if (check_inverse(optarg, &invert, NULL, 0))
                         exit_error(PARAMETER_PROBLEM, "quota: unexpected '!'");
                 if (!parse_quota(optarg, &info->quota))
                         exit_error(PARAMETER_PROBLEM,

diff --git a/extensions/libipt_realm.c b/extensions/libipt_realm.c
index f0dea00fa6902803470c9958bef5906268188b63..77e6a3e0afe6f19a833287380c0caed1a9dc5af0 100644 (file)
--- a/extensions/libipt_realm.c
+++ b/extensions/libipt_realm.c
@@ -49,8 +49,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
        switch (c) {
                char *end;
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                realminfo->id = strtoul(optarg, &end, 0);
                if (*end == '/') {
                        realminfo->mask = strtoul(end+1, &end, 0);

diff --git a/extensions/libipt_recent.c b/extensions/libipt_recent.c
index 48cc8140b82d95b79fa1ecf972653262f879837b..d796d5620d7b9c070f8a10fb19e4d3cd2c9a76ad 100644 (file)
--- a/extensions/libipt_recent.c
+++ b/extensions/libipt_recent.c
@@ -70,7 +70,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        if (*flags) exit_error(PARAMETER_PROBLEM,
                                        "recent: only one of `--set', `--check' "
                                        "`--update' or `--remove' may be set");
-                       if (check_inverse(optarg, &invert)) optind++;
+                       check_inverse(optarg, &invert, &optind, 0);
                        info->check_set |= IPT_RECENT_SET;
                        if (invert) info->invert = 1;
                        *flags = 1;
@@ -80,7 +80,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        if (*flags) exit_error(PARAMETER_PROBLEM,
                                        "recent: only one of `--set', `--check' "
                                        "`--update' or `--remove' may be set");
-                       if (check_inverse(optarg, &invert)) optind++;
+                       check_inverse(optarg, &invert, &optind, 0);
                        info->check_set |= IPT_RECENT_CHECK;
                        if(invert) info->invert = 1;
                        *flags = 1;
@@ -90,7 +90,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        if (*flags) exit_error(PARAMETER_PROBLEM,
                                        "recent: only one of `--set', `--check' "
                                        "`--update' or `--remove' may be set");
-                       if (check_inverse(optarg, &invert)) optind++;
+                       check_inverse(optarg, &invert, &optind, 0);
                        info->check_set |= IPT_RECENT_UPDATE;
                        if (invert) info->invert = 1;
                        *flags = 1;
@@ -100,7 +100,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        if (*flags) exit_error(PARAMETER_PROBLEM,
                                        "recent: only one of `--set', `--check' "
                                        "`--update' or `--remove' may be set");
-                       if (check_inverse(optarg, &invert)) optind++;
+                       check_inverse(optarg, &invert, &optind, 0);
                        info->check_set |= IPT_RECENT_REMOVE;
                        if (invert) info->invert = 1;
                        *flags = 1;

diff --git a/extensions/libipt_state.c b/extensions/libipt_state.c
index 25bc2a2c113a95940e71f4478fe32375c328f2aa..0c2b4f8ebeefeea6e5c03c3450a9f65d593cfeab 100644 (file)
--- a/extensions/libipt_state.c
+++ b/extensions/libipt_state.c
@@ -75,8 +75,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                parse_states(argv[optind-1], sinfo);
                if (invert)

diff --git a/extensions/libipt_string.c b/extensions/libipt_string.c
index b9f38d7a570f77a0384b706279f037800a569888..96801b314a957ba059d4156ef1f4ac3dbe0f40cc 100644 (file)
--- a/extensions/libipt_string.c
+++ b/extensions/libipt_string.c
@@ -60,8 +60,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_string(argv[optind-1], stringinfo);
                if (invert)
                        stringinfo->invert = 1;

diff --git a/extensions/libipt_tcp.c b/extensions/libipt_tcp.c
index 7f172529fb14a35e781fcf490f6db2f8c0cc2a80..85f6d786aa7c8c06110a3510c755f7c84cb8f7cb 100644 (file)
--- a/extensions/libipt_tcp.c
+++ b/extensions/libipt_tcp.c
@@ -178,8 +178,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & TCP_SRC_PORTS)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--source-port' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_tcp_ports(argv[optind-1], tcpinfo->spts);
                if (invert)
                        tcpinfo->invflags |= IPT_TCP_INV_SRCPT;
@@ -191,8 +190,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & TCP_DST_PORTS)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--destination-port' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_tcp_ports(argv[optind-1], tcpinfo->dpts);
                if (invert)
                        tcpinfo->invflags |= IPT_TCP_INV_DSTPT;
@@ -215,8 +213,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one of `--syn' or `--tcp-flags' "
                                   " allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
 
                if (!argv[optind]
                    || argv[optind][0] == '-' || argv[optind][0] == '!')
@@ -234,8 +231,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & TCP_OPTION)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--tcp-option' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_tcp_option(argv[optind-1], &tcpinfo->option);
                if (invert)
                        tcpinfo->invflags |= IPT_TCP_INV_OPTION;

diff --git a/extensions/libipt_tcpmss.c b/extensions/libipt_tcpmss.c
index 92e05392bcf5a9ef383a975fa6e68aa9402bd4e0..87353bfe07149909782f4328324e56570f6fc3fe 100644 (file)
--- a/extensions/libipt_tcpmss.c
+++ b/extensions/libipt_tcpmss.c
@@ -79,8 +79,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--mss' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_tcp_mssvalues(argv[optind-1],
                                    &mssinfo->mss_min, &mssinfo->mss_max);
                if (invert)

diff --git a/extensions/libipt_tos.c b/extensions/libipt_tos.c
index a1ef4e6e5ee457aef304ffea7679b978197b5c88..3d4616f60d5483b2efb838177aa8d7ce3e32e9e5 100644 (file)
--- a/extensions/libipt_tos.c
+++ b/extensions/libipt_tos.c
@@ -91,8 +91,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
 
        switch (c) {
        case '1':
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_tos(argv[optind-1], tosinfo);
                if (invert)
                        tosinfo->invert = 1;

diff --git a/extensions/libipt_ttl.c b/extensions/libipt_ttl.c
index 61635f789885c7bc1f11c58c770b607e79d2c61b..4ef976433b1d7adec20e6494c4f122b9ca1a2938 100644 (file)
--- a/extensions/libipt_ttl.c
+++ b/extensions/libipt_ttl.c
@@ -1,7 +1,7 @@
 /* Shared library add-on to iptables to add TTL matching support 
  * (C) 2000 by Harald Welte <laforge@gnumonks.org>
  *
- * $Id: libipt_ttl.c,v 1.4 2000/11/13 11:16:08 laforge Exp $
+ * $Id: libipt_ttl.c,v 1.4 2002/02/25 11:25:41 laforge Exp $
  *
  * This program is released under the terms of GNU GPL */
 
@@ -37,8 +37,7 @@ static int parse(int c, char **argv, int invert, unsigned int *flags,
        struct ipt_ttl_info *info = (struct ipt_ttl_info *) (*match)->data;
        u_int8_t value;
 
-       if (check_inverse(optarg, &invert))
-               optind++;
+       check_inverse(optarg, &invert, &optind, 0);
        value = atoi(argv[optind-1]);
 
        if (*flags) 

diff --git a/extensions/libipt_udp.c b/extensions/libipt_udp.c
index 3db35b1bc8450b097ef1ba6dd8d5ae78078c2533..6b6b99611cbc8e395dc03953900a02a16de0fa56 100644 (file)
--- a/extensions/libipt_udp.c
+++ b/extensions/libipt_udp.c
@@ -100,8 +100,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & UDP_SRC_PORTS)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--source-port' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_udp_ports(argv[optind-1], udpinfo->spts);
                if (invert)
                        udpinfo->invflags |= IPT_UDP_INV_SRCPT;
@@ -113,8 +112,7 @@ parse(int c, char **argv, int invert, unsigned int *flags,
                if (*flags & UDP_DST_PORTS)
                        exit_error(PARAMETER_PROBLEM,
                                   "Only one `--destination-port' allowed");
-               if (check_inverse(optarg, &invert))
-                       optind++;
+               check_inverse(optarg, &invert, &optind, 0);
                parse_udp_ports(argv[optind-1], udpinfo->dpts);
                if (invert)
                        udpinfo->invflags |= IPT_UDP_INV_DSTPT;

diff --git a/include/iptables_common.h b/include/iptables_common.h
index 12b579758623fb34177b0995833d61b0b4c64e45..25f23c3cd6f1947e44f6c17348ec29b870184475 100644 (file)
--- a/include/iptables_common.h
+++ b/include/iptables_common.h
@@ -9,7 +9,7 @@ enum exittype {
 };
 extern void exit_printhelp() __attribute__((noreturn));
 extern void exit_tryhelp(int) __attribute__((noreturn));
-int check_inverse(const char option[], int *invert);
+int check_inverse(const char option[], int *invert, int *optind, int argc);
 extern int string_to_number(const char *, 
                            unsigned int, 
                            unsigned int,

diff --git a/ip6tables.c b/ip6tables.c
index 22d636eb60e72402cc0b74ba6af1cd373a5e10ad..b4d6ea550fa6c882a7c64bae30bce9dda8023cee 100644 (file)
--- a/ip6tables.c
+++ b/ip6tables.c
@@ -424,14 +424,20 @@ add_command(int *cmd, const int newcmd, const int othercmds, int invert)
 }
 
 int
-check_inverse(const char option[], int *invert)
+check_inverse(const char option[], int *invert, int *optind, int argc)
 {
        if (option && strcmp(option, "!") == 0) {
                if (*invert)
                        exit_error(PARAMETER_PROBLEM,
                                   "Multiple `!' flags not allowed");
-
                *invert = TRUE;
+               if (optind) {
+                       *optind = *optind+1;
+                       if (argc && *optind > argc)
+                               exit_error(PARAMETER_PROBLEM,
+                                          "no argument following `!'");
+               }
+
                return TRUE;
        }
        return FALSE;
@@ -1838,8 +1844,7 @@ int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle)
                         * Option selection
                         */
                case 'p':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_PROTOCOL, &fw.ipv6.invflags,
                                   invert);
 
@@ -1861,8 +1866,7 @@ int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle)
                        break;
 
                case 's':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_SOURCE, &fw.ipv6.invflags,
                                   invert);
                        shostnetworkmask = argv[optind-1];
@@ -1870,8 +1874,7 @@ int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle)
                        break;
 
                case 'd':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_DESTINATION, &fw.ipv6.invflags,
                                   invert);
                        dhostnetworkmask = argv[optind-1];
@@ -1901,8 +1904,7 @@ int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle)
 
 
                case 'i':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_VIANAMEIN, &fw.ipv6.invflags,
                                   invert);
                        parse_interface(argv[optind-1],
@@ -1912,8 +1914,7 @@ int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle)
                        break;
 
                case 'o':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_VIANAMEOUT, &fw.ipv6.invflags,
                                   invert);
                        parse_interface(argv[optind-1],

diff --git a/iptables.c b/iptables.c
index 25e6d9f910a51271e59a850a19facc9f1cb426d9..8e4c13af984ad35a1209ff4b001b5b2cf6443cf2 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -476,14 +476,20 @@ add_command(int *cmd, const int newcmd, const int othercmds, int invert)
 }
 
 int
-check_inverse(const char option[], int *invert)
+check_inverse(const char option[], int *invert, int *optind, int argc)
 {
        if (option && strcmp(option, "!") == 0) {
                if (*invert)
                        exit_error(PARAMETER_PROBLEM,
                                   "Multiple `!' flags not allowed");
-
                *invert = TRUE;
+               if (optind) {
+                       *optind = *optind+1;
+                       if (argc && *optind > argc)
+                               exit_error(PARAMETER_PROBLEM,
+                                          "no argument following `!'");
+               }
+
                return TRUE;
        }
        return FALSE;
@@ -1834,8 +1840,7 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle)
                         * Option selection
                         */
                case 'p':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_PROTOCOL, &fw.ip.invflags,
                                   invert);
 
@@ -1854,8 +1859,7 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle)
                        break;
 
                case 's':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_SOURCE, &fw.ip.invflags,
                                   invert);
                        shostnetworkmask = argv[optind-1];
@@ -1863,8 +1867,7 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle)
                        break;
 
                case 'd':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_DESTINATION, &fw.ip.invflags,
                                   invert);
                        dhostnetworkmask = argv[optind-1];
@@ -1894,8 +1897,7 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle)
 
 
                case 'i':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_VIANAMEIN, &fw.ip.invflags,
                                   invert);
                        parse_interface(argv[optind-1],
@@ -1905,8 +1907,7 @@ int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle)
                        break;
 
                case 'o':
-                       if (check_inverse(optarg, &invert))
-                               optind++;
+                       check_inverse(optarg, &invert, &optind, argc);
                        set_option(&options, OPT_VIANAMEOUT, &fw.ip.invflags,
                                   invert);
                        parse_interface(argv[optind-1],