Make '-p all' a special case that is handled before calling getprotoent() (Closes: #446)
diff --git a/iptables.c b/iptables.c
index b66e5e1..c8ab71e 100644
--- a/iptables.c
+++ b/iptables.c
@@ -229,7 +229,6 @@
{ "esp", IPPROTO_ESP },
{ "ah", IPPROTO_AH },
{ "sctp", IPPROTO_SCTP },
- { "all", 0 },
};
static char *
@@ -756,6 +755,13 @@
if (string_to_number(s, 0, 255, &proto) == -1) {
struct protoent *pent;
+ /* first deal with the special case of 'all' to prevent
+ * people from being able to redefine 'all' in nsswitch
+ * and/or provoke expensive [not working] ldap/nis/...
+ * lookups */
+ if (!strcmp(s, "all"))
+ return 0;
+
if ((pent = getprotobyname(s)))
proto = pent->p_proto;
else {