Date: Tue, 18 Jan 2000 12:43:43 -0500 (EST) From: "Crist J. Clark" <cjc@cc942873-a.ewndsr1.nj.home.com> To: FreeBSD-gnats-submit@freebsd.org Subject: bin/16179: ipfw(8) poor design of command line parsing Message-ID: <200001181743.MAA65891@cc942873-a.ewndsr1.nj.home.com>
next in thread | raw e-mail | index | archive | help
>Number: 16179
>Category: bin
>Synopsis: ipfw(8) poor design of command line parsing
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Tue Jan 18 09:40:03 PST 2000
>Closed-Date:
>Last-Modified:
>Originator: Crist J. Clark
>Release: FreeBSD 3.4-STABLE i386
>Organization:
>Environment:
FreeBSD 3.4-STABLE. It looks like the major problem was
introduced when the option to pre-process IPFW rule files was
added. It exists in 2.2.8-STABLE but occurs under more restricted
conditions.
>Description:
The design of the ipfw(8) command line parser is poorly
designed. The first check it does is whether the last argument on the
command line is a readable file. If it is, ipfw assumes that it is a
script containing IPFW rules. Therefore, if a user or script ever
executes an ipfw command in which the last argument on the command
line is a readable file, the command will fail if the file is not in
fact a set of IPFW rules.
I entered this as a 'change request' rather than 'bug,' but it
is a borderline case, IMHO.
>How-To-Repeat:
The problem was brought to my attention by a user who was
having all commands that ended with the "setup" keyword fail. He had a
file named "setup" in the pwd.
The code for this in /usr/src/sbin/ipfw.c quite clearly,
if (ac > 1 && access(av[ac - 1], R_OK) == 0) {
shows this is the intended, coded behavior. The above code is the
first treatment of command line args (ac = argc, av = argv) and if hte
above evaluates true, it is assumed the ipfw command is of the form,
ipfw [-q] [-p preproc [-D macro[=value]] [-U macro]] file
Although the occurance of readable files with names of words
that might appear at the end of an ipfw command line is admittedly
low, this problem can be corrected with minor, but non-negligbile,
effort.
>Fix:
To maintain back-compatibility, changing the format for ipfw
command to read IPFW rule files is not a viable solution. The manner
in which command line parsing is done would need
restructuring. One possible method is scanning for keywords at the
begining of a rule (flush, zero, delete, resetlog, list, show, add)
first. If the command line does not contain one of these, _then_ the
line should be treated as one with a IPFW rule file.
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200001181743.MAA65891>