diff options
| author | Florian Westphal <fw@strlen.de> | 2020-06-24 11:55:14 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2020-12-16 00:35:56 +0100 |
| commit | 47ed20e1e08d800e722b05a3fb33ba6be4b48afc (patch) | |
| tree | 7bb43b776909f5f66e06c41e2c7ba07d506da14d /src/shared/firewall-util.c | |
| parent | 937e305e9305a9104cfb1362f318d9df5943b8a5 (diff) | |
| download | systemd-47ed20e1e08d800e722b05a3fb33ba6be4b48afc.tar.gz | |
firewall-util: reject NULL source or address with prefixlen 0
Make sure we don't add masquerading rules without a explicitly
specified network range we should be masquerading for.
The only caller aside from test case is
networkd-address.c which never passes a NULL source.
As it also passes the network prefix, that should always be > 0 as well.
This causes expected test failure:
Failed to modify firewall: Invalid argument
Failed to modify firewall: Invalid argument
Failed to modify firewall: Invalid argument
Failed to modify firewall: Protocol not available
Failed to modify firewall: Protocol not available
Failed to modify firewall: Protocol not available
Failed to modify firewall: Protocol not available
The failing test cases are amended to expect failure on
NULL source or prefix instead of success.
Diffstat (limited to 'src/shared/firewall-util.c')
| -rw-r--r-- | src/shared/firewall-util.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/shared/firewall-util.c b/src/shared/firewall-util.c index 974803903d..df020ba7a2 100644 --- a/src/shared/firewall-util.c +++ b/src/shared/firewall-util.c @@ -98,6 +98,9 @@ int fw_add_masquerade( if (af != AF_INET) return -EOPNOTSUPP; + if (!source || source_prefixlen == 0) + return -EINVAL; + h = iptc_init("nat"); if (!h) return -errno; |