Joungkyun / oops-firewall

oops-firewall :: Linux Firewall (iptables frontend)
Other
0 stars 1 forks source link

user.conf :: syntax errors occur when option value has white space #2

Open Joungkyun opened 1 year ago

Joungkyun commented 1 year ago

if set follow in user.conf

%-A INPUT -p tcp --dport 80 -m string --algo bm --string 'GET /?twclid=' -j DROP

occurs follow errors.

  * /usr/sbin/iptables -A INPUT -p tcp --dport 80 -m string --algo bm --string 'GET /?twclid=' -j DROP
Bad argument `/?twclid=''
Try `iptables -h' or 'iptables --help' for more information.

It maybe occurs follow code. https://github.com/Joungkyun/oops-firewall/blob/439be7f6d9d145412305632f4d2d9e4181b9f766/src/include/command.h#L403-L404

It will need to execute with eval function

Joungkyun commented 1 year ago

consider follow patch

--- command.h.org   2022-10-25 21:00:44.215566417 +0900
+++ command.h   2022-10-25 21:24:42.716202521 +0900
@@ -384,25 +384,23 @@ user_cmd () {
            brute_force_set
            layer7_set
            USERCHK=$(LANG="C" ${c_sed} -n -f ${_includes}/user_pre.sed ${_confdir}/user.conf)
-           IFS='%'
            ;;
        post)
            USERCHK=$(LANG="C" ${c_sed} -n -f ${_includes}/user_post.sed ${_confdir}/user.conf)
-           IFS='@'
            ;;
    esac

    if [ -n "${USERCHK}" ]; then
-       for uvalue in ${USERCHK}
-       do
-           IFS=' '
-           if [ -z "${uvalue}" ]; then
-               continue;
+
+       while read line
+       do
+           uvalue="$( sed -r 's/[[:space:]]*$//g' <<< "${line}" )"
+           [[ -z ${uvalue} ]] && continue
+           o_echo "  * ${c_iptables} ${uvalue:1}"
+           if (( _testmode == 0 )); then
+               eval "${c_iptables} ${uvalue:1}" || true
            fi
-           uvalue=$(echo ${uvalue})
-           o_echo "  * ${c_iptables} ${uvalue}"
-           [ $_testmode -eq 0 ] && ${c_iptables} ${uvalue} || true
-       done
+       done <<< "${USERCHK}"
    else
        IFS=' '
        case "$1" in

a.zip