libxt_policy: option table fixes, improved error tracking

Most of the flags are multi-use in this extension. Also transfer
--next => --strict requirement to option table.

Furthermore, augment the error messages emitted from fcheck to contain
the policy element number, and elaborate on what an "empty policy
element" is.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

diff --git a/extensions/libxt_policy.c b/extensions/libxt_policy.c
index a514246cce8849cc3a1a7c5d677d925eb50f1203..7affd1b0cac9417653f65762cf845a47273de5f6 100644 (file)
--- a/extensions/libxt_policy.c
+++ b/extensions/libxt_policy.c
@@ -16,7 +16,8 @@ enum {
        O_MODE,
        O_TUNNELSRC,
        O_TUNNELDST,
-       O_NEXT
+       O_NEXT,
+       F_STRICT = 1 << O_STRICT,
 };
 
 static void policy_help(void)
@@ -28,6 +29,7 @@ static void policy_help(void)
 "  --pol none|ipsec            match policy\n"
 "  --strict                    match entire policy instead of single element\n"
 "                              at any position\n"
+"These options may be used repeatedly, to describe policy elements:\n"
 "[!] --reqid reqid             match reqid\n"
 "[!] --spi spi                 match SPI\n"
 "[!] --proto proto             match protocol (ah/esp/ipcomp)\n"
@@ -42,13 +44,20 @@ static const struct xt_option_entry policy_opts[] = {
         .flags = XTOPT_INVERT},
        {.name = "pol", .id = O_POLICY, .type = XTTYPE_STRING},
        {.name = "strict", .id = O_STRICT, .type = XTTYPE_NONE},
-       {.name = "reqid", .id = O_REQID, .type = XTTYPE_UINT32},
-       {.name = "spi", .id = O_SPI, .type = XTTYPE_UINT32},
-       {.name = "tunnel-src", .id = O_TUNNELSRC, .type = XTTYPE_HOSTMASK},
-       {.name = "tunnel-dst", .id = O_TUNNELDST, .type = XTTYPE_HOSTMASK},
-       {.name = "proto", .id = O_PROTO, .type = XTTYPE_STRING},
-       {.name = "mode", .id = O_MODE, .type = XTTYPE_STRING},
-       {.name = "next", .id = O_NEXT, .type = XTTYPE_NONE},
+       {.name = "reqid", .id = O_REQID, .type = XTTYPE_UINT32,
+        .flags = XTOPT_MULTI | XTOPT_INVERT},
+       {.name = "spi", .id = O_SPI, .type = XTTYPE_UINT32,
+        .flags = XTOPT_MULTI | XTOPT_INVERT},
+       {.name = "tunnel-src", .id = O_TUNNELSRC, .type = XTTYPE_HOSTMASK,
+        .flags = XTOPT_MULTI | XTOPT_INVERT},
+       {.name = "tunnel-dst", .id = O_TUNNELDST, .type = XTTYPE_HOSTMASK,
+        .flags = XTOPT_MULTI | XTOPT_INVERT},
+       {.name = "proto", .id = O_PROTO, .type = XTTYPE_STRING,
+        .flags = XTOPT_MULTI | XTOPT_INVERT},
+       {.name = "mode", .id = O_MODE, .type = XTTYPE_STRING,
+        .flags = XTOPT_MULTI | XTOPT_INVERT},
+       {.name = "next", .id = O_NEXT, .type = XTTYPE_NONE,
+        .flags = XTOPT_MULTI, .also = F_STRICT},
        XTOPT_TABLEEND,
 };
 
@@ -183,9 +192,14 @@ static void policy_check(struct xt_fcheck_call *cb)
        } else
                info->len++;    /* increase len by 1, no --next after last element */
 
+       /*
+        * This is already represented with O_NEXT requiring F_STRICT in the
+        * options table, but will keep this code as a comment for reference.
+        *
        if (!(info->flags & XT_POLICY_MATCH_STRICT) && info->len > 1)
                xtables_error(PARAMETER_PROBLEM,
                           "policy match: multiple elements but no --strict");
+        */
 
        for (i = 0; i < info->len; i++) {
                e = &info->pol[i];
@@ -194,7 +208,10 @@ static void policy_check(struct xt_fcheck_call *cb)
                    !(e->match.reqid || e->match.spi || e->match.saddr ||
                      e->match.daddr || e->match.proto || e->match.mode))
                        xtables_error(PARAMETER_PROBLEM,
-                                  "policy match: empty policy element");
+                               "policy match: empty policy element %u. "
+                               "--strict is in effect, but at least one of "
+                               "reqid, spi, tunnel-src, tunnel-dst, proto or "
+                               "mode is required.", i);
 
                if ((e->match.saddr || e->match.daddr)
                    && ((e->mode == XT_POLICY_MODE_TUNNEL && e->invert.mode) ||

diff --git a/extensions/libxt_policy.man b/extensions/libxt_policy.man
index 3500025c8028e12ef840a2942a13beca47a44185..1b834fa06c785b39efa93b4d89f565517fc90942 100644 (file)
--- a/extensions/libxt_policy.man
+++ b/extensions/libxt_policy.man
@@ -13,11 +13,16 @@ is valid in the
 chains.
 .TP
 \fB\-\-pol\fP {\fBnone\fP|\fBipsec\fP}
-Matches if the packet is subject to IPsec processing.
+Matches if the packet is subject to IPsec processing. \fB\-\-pol none\fP
+cannot be combined with \fB\-\-strict\fP.
 .TP
 \fB\-\-strict\fP
 Selects whether to match the exact policy or match if any rule of
 the policy matches the given policy.
+.PP
+For each policy element that is to be described, one can use one or more of
+the following options. When \fB\-\-strict\fP is in effect, at least one must be
+used per element.
 .TP
 [\fB!\fP] \fB\-\-reqid\fP \fIid\fP
 Matches the reqid of the policy rule. The reqid can be specified with