firewall-util: reject NULL source or address with prefixlen 0

Make sure we don't add masquerading rules without a explicitly
specified network range we should be masquerading for.

The only caller aside from test case is
networkd-address.c which never passes a NULL source.

As it also passes the network prefix, that should always be > 0 as well.

This causes expected test failure:
Failed to modify firewall: Invalid argument
Failed to modify firewall: Invalid argument
Failed to modify firewall: Invalid argument
Failed to modify firewall: Protocol not available
Failed to modify firewall: Protocol not available
Failed to modify firewall: Protocol not available
Failed to modify firewall: Protocol not available

The failing test cases are amended to expect failure on
NULL source or prefix instead of success.

This commit is contained in:

Florian Westphal

2020-12-16 00:35:56 +01:00

parent 937e305e93

commit 47ed20e1e0

2 changed files with 19 additions and 2 deletions

									
										src/shared/firewall-util.c
									
		+3
		
												View File
												
				@@ -98,6 +98,9 @@ int fw_add_masquerade(

				        if (af != AF_INET)

				                return -EOPNOTSUPP;

				        if (!source || source_prefixlen == 0)

				                return -EINVAL;

				        h = iptc_init("nat");

				        if (!h)

				                return -errno;