summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: cthelper: ssdp: Fix parsing of IPv6 M-SEARCH requests.Aaron Thompson2022-01-091-6/+2
| | | | | | | | Use the already correctly determined transport header offset instead of assuming that the packet is IPv4. Signed-off-by: Aaron Thompson <dev@aaront.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass sock to nfct_mnl_*() functionsMikhail Sennikovsky2021-12-241-53/+62
| | | | | | | | In preparation for using multiple instances of mnl sockets required for conntrack entries update and delete support. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl to create entryPablo Neira Ayuso2021-12-241-6/+26
| | | | | | | Use libmnl to create entries through the new nfct_mnl_create() helper function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add netlink flags to nfct_mnl_nlmsghdr_put()Pablo Neira Ayuso2021-12-241-4/+4
| | | | | | | Moreover, remove NLM_F_DUMP for IPCTNL_MSG_CT_GET_STATS since ctnetlink ignores this flag, this is simple netlink get command, not a dump. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add nfct_mnl_talk() and nfct_mnl_recv() helper functionsPablo Neira Ayuso2021-12-241-20/+34
| | | | | | Add helper function to consolidate nfct_mnl_dump() and nfct_mnl_get(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove MAINTAINERCLEANFILESJeremy Sowden2021-12-171-1/+0
| | | | | | | | | automake generates rules to remove the files generated by bison and flex by default, so there is no need to add them explicitly to MAINTAINERCLEANFILES. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for listing conntrack tablePablo Neira Ayuso2021-11-141-20/+16
| | | | | | | Use libmnl and libnetfilter_conntrack mnl helpers to dump the conntrack table entries. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: enhance mnl_nfct_dump_cb()Pablo Neira Ayuso2021-11-141-12/+39
| | | | | | Add missing features in dump_cb() to mnl_nfct_dump_cb(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass filter_dump object to nfct_mnl_dump()Pablo Neira Ayuso2021-11-141-5/+10
| | | | | | In preparation for kernel filtering support for nfct_mnl_dump(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: do not include conntrack ID in hashtable cmpPablo Neira Ayuso2021-11-081-10/+1
| | | | | | | | | Depending on your conntrackd configuration, events might get lost, leaving stuck entries in the cache forever. Skip checking the conntrack ID to allow for lazy cleanup by when a new entry that is represented by the same tuple is added. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fix dependency-tracking of yacc-generated headerJeremy Sowden2021-09-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | List it as a built source in order to force make to create it before compilation. Otherwise, a parallel make can end up attempting to compile the output of lex before yacc has finished generating its own output: $ make -j17 [...] YACC read_config_yy.c LEX read_config_lex.c CC stack.o CC resync.o CC cthelper.o CC helpers.o CC utils.o CC expect.o CC systemd.o CC nfct.o CC nfct-extensions/helper.o CC nfct-extensions/timeout.o CC read_config_lex.o read_config_lex.l:25:10: fatal error: read_config_yy.h: No such file or directory 25 | #include "read_config_yy.h" | ^~~~~~~~~~~~~~~~~~ compilation terminated. make[2]: *** [Makefile:701: read_config_lex.o] Error 1 make[2]: *** Waiting for unfinished jobs.... updating read_config_yy.h make[2]: Leaving directory '/space/azazel/work/git/netfilter/conntrack-tools/src' make[1]: *** [Makefile:743: all-recursive] Error 1 make[1]: Leaving directory '/space/azazel/work/git/netfilter/conntrack-tools/src' make: *** [Makefile:541: all-recursive] Error 1 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: clean yacc- and lex-generated files with maintainer-cleanJeremy Sowden2021-09-271-1/+1
| | | | | | | | | Automake expects to distribute yacc- and lex-generated sources, so that the user doesn't need to regenerate them. Therefore, the appropriate target to clean them is `maintainer-clean`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove yacc-generated header from EXTRA_DISTJeremy Sowden2021-09-271-2/+0
| | | | | | | | Automake generates yacc and lex output files and includes them in distributions as a matter of course. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: conntrackd: add #include <linux/netfilter/nfnetlink_queue.h>Pablo Neira Ayuso2021-09-209-0/+9
| | | | | | | | This fixes this warning: #warning "libnetfilter_queue/linux_nfnetlink_queue.h is deprecated, add #include <linux/netfilter/nfnetlink_queue.h> to your source code before #include <libnetfilter_queue/libnetfilter_queue.h> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cache: fix zone entry uniqueness in external cacheAdam Casella2021-09-201-4/+6
| | | | | | | | | In some use-cases, zone is used to differetiate conntrack state. This preserves that uniqueness by adding zone into the cache in addtion to 5-tuple data This preserves external-cache uniqueness per zone when synced. Fixes: a08af5d26297 ("conntrack: fix zone sync issue") Signed-off-by: Adam Casella <adam.casella1984@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for chaintoolong stat counterFlorian Westphal2021-09-081-3/+4
| | | | | | | | | | | | | | | | | While at it, also fix up commit 5ec55c2a0a264 ("conntrack: add support for CLASH_RESOLVED counter"). The intention was to also print unknown statistic counters provided the attributes are of type u32, but mnl_attr_type_valid() needs the correct max-attr number for this to work. With this fix in place, conntrack -S shows: cpu=3 found=0 inv[..] clash_resolve=0 unknown1=8200 on a modified kernel. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add shorthand mnemonic for UNREPLIEDFlorian Westphal2021-08-051-0/+12
| | | | | | | | | conntrack tool prints [UNREPLIED] if a conntrack entry lacks the SEEN_REPLY bit. Accept this as '-u' argument too. If requested, mask is set to SEEN_REPLY and value remains 0 (bit not set). Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: enable kernel-based status filtering with -L -u STATUSFlorian Westphal2021-08-051-4/+55
| | | | | | | | | This change is backwards compatible: Old kernels do not recognize CTA_STATUS_MASK attribute and will ignore it (no filtering in kernel). Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrackd: cthelper: Set up userspace helpers when daemon startsPablo Neira Ayuso2021-05-283-1/+17
| | | | | | | Add a new setting to allow conntrackd to autoconfigure the userspace helpers at startup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix endianness bug in IPv4 and IPv6 addressPablo Neira Ayuso2021-05-032-13/+28
| | | | | | | | Add ct_parse_be32() and ct_parse_be128() and use them to deal with an IP address which is already in network byte order. Reported-by: Tao Gong <gongtao0607@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: accept commands from fileMikhail Sennikovsky2021-05-031-6/+219
| | | | | | | | | | | | | | | | | | | | | | | | | | This commit implements the --load-file option which allows processing conntrack commands stored in file. Most often this would be used as a counter-part for the -o save option, which outputs conntrack entries in the format of the conntrack tool options. This could be useful when one needs to add/update/delete a large set of ct entries with a single conntrack tool invocation. This patch introduces a ct_cmd_list, which represents a list of ct_cmd elements. Expected syntax is "conntrack --load-file file". If "-" is given as a file name, stdin is used. No other commands or options are allowed to be specified in conjunction with the --load-file command. It is however possible to specify multiple --load-file file pairs. Example: Copy all entries from ct zone 11 to ct zone 12: conntrack -L -w 11 -o save | sed "s/-w 11/-w 12/g" | \ conntrack --load-file - Joint work with Pablo. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: release options after parsingPablo Neira Ayuso2021-05-031-1/+2
| | | | | | | | | | | | | | | Fix memleak in parser: ==8445== 3,808 bytes in 2 blocks are definitely lost in loss record 6 of 6 ==8445== at 0x483577F: malloc (vg_replace_malloc.c:299) ==8445== by 0x112636: merge_options (conntrack.c:1056) ==8445== by 0x112636: do_parse (conntrack.c:2903) ==8445== by 0x11343E: ct_file_parse_line (conntrack.c:3672) ==8445== by 0x11343E: ct_parse_file (conntrack.c:3693) ==8445== by 0x10D819: main (conntrack.c:3750) Fixes: 8f76d6360dbf ("conntrack: add struct ct_cmd") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add function to print command statsPablo Neira Ayuso2021-03-151-8/+17
| | | | | | Wrap code to display command stats in a function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: move options flag to ct_cmd objectPablo Neira Ayuso2021-03-151-48/+59
| | | | | | Prepare for the batch support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass cmd to filter nat, mark and network functionsPablo Neira Ayuso2021-03-151-10/+11
| | | | | | | Pass the command object to the nat, mark and IP address userspace filters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass cmd to nfct_filter()Pablo Neira Ayuso2021-03-151-10/+9
| | | | | | Pass the command object to the userspace filter routine. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass ct_cmd to nfct_filter_init()Pablo Neira Ayuso2021-03-151-6/+8
| | | | | | Pass command object to initialize the userspace filter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pass command object to callbacksPablo Neira Ayuso2021-03-151-23/+27
| | | | | | | | | Pass the command object to prepare for batch support. Move ct_cmd structure definition right at the top of file otherwise compilation breaks. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: set default hashtable buckets and max entries if not specifiedPablo Neira Ayuso2021-03-081-0/+6
| | | | | | | | | | | Fall back to 65536 buckets and 262144 entries. It would be probably good to add code to autoadjust by reading /proc/sys/net/netfilter/nf_conntrack_buckets and /proc/sys/net/nf_conntrack_max. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1491 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: introduce yes & no config valuesArturo Borrero Gonzalez2021-02-011-2/+6
| | | | | | They are equivalent of 'on' and 'off' and makes the config easier to understand. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* conntrack: add do_command_ct()Pablo Neira Ayuso2021-01-141-20/+24
| | | | | | Wrap the code to run the command around the do_command_ct() function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add struct ct_tmplPablo Neira Ayuso2021-01-141-110/+121
| | | | | | | | | | | | | | Remove the global template object, add it to struct ct_cmd. This patch prepares for the batch support. The global cur_tmpl pointer is used to access the template from the callbacks and the exit_error() path. Note that it should be possible to remove this global cur_tmpl pointer by passing the new command object as parameter to the callbacks and exit_error(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add struct ct_cmdPablo Neira Ayuso2021-01-141-49/+76
| | | | | | | This new object stores the result of the command parser, this prepares for batch support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: pretty-print the portidFlorian Westphal2020-12-171-7/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DESTROY events already include the portid. Add some /proc glue to lookup the portid. Problem is that there is no direct mapping to a name. Lookup steps are: 1. Obtain the portid inode from /proc/net/netlink. If we can't even find that, no luck. 2. assume portid == pid and search /proc/portid/fd/ for a socket with matching inode. This is modeled on iproute2 ss tool. If /proc/portid/fd/ comes up empty, entire process space (/proc/*/fd) is searched for a matching inode. As this is quite some work, cache the last portid result (including 'not found', so that 'conntrack -F' generating 10000k events will do this lookup only once. The lookup won't work in case the deleting/flushing program has already exited; in that case [USERSPACE] tag and portid are still included. Example: $ conntrack -E -o userspace [DESTROY] tcp 6 src=192... dst=192... sport=4404 dport=22 ... [USERSPACE] portid=5146 progname=conntrack Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrackd: external_inject: report inject issues as warningArturo Borrero Gonzalez2020-12-081-9/+19
| | | | | | | | | | | | | | | | | | | | | | | In busy firewalls that run conntrackd in NOTRACK with both internal and external caches disabled, external_inject can get lots of traffic. In case of issues injecting or updating conntrack entries a log entry will be generated, the infamous inject-addX, inject-updX messages. But there is nothing end users can do about this error message, which is purely internal. This patch is basically cosmetic, relaxing the message from ERROR to WARNING. The information reported is also extended a bit. The idea is to leave ERROR messages to issues that would *stop* or *prevent* conntrackd from working at all. Another nice thing to do in the future is to rate-limit this message, which is generated in the data path and can easily fill log files. But ideally, the actual root cause would be fixed, and there would be no WARNING message reported at all, meaning that all conntrack entries are smoothly synced between the firewalls in the cluster. We can work on that later. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: implement save output formatMikhail Sennikovsky2020-11-021-4/+279
| | | | | | | | | | | | | | | This commit allows dumping conntrack entries in the format used by the conntrack parameters, aka "save" output format. This is useful for saving ct entry data to allow applying it later on. To enable the "save" output the "-o save" parameter needs to be passed to the conntrack tool invocation. [ pablo@netfilter.org: several updates to the original patch ] Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to flush per familyPablo Neira Ayuso2020-10-291-2/+2
| | | | | | | | This allows users to flush IPv4 entries only through: conntrack -F -f ipv4 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to filter event by familyPablo Neira Ayuso2020-10-281-2/+5
| | | | | | | | This patch allows you to filter event through -f, e.g. conntrack -E -f ipv4 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: default to unspec family for dualstack setupsPablo Neira Ayuso2020-10-271-3/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2bcbae4c14b2 ("conntrack: -f family filter does not work") restored the fallback to IPv4 if -f is not specified, which was the original behaviour. This patch modifies the default to use the unspec family if -f is not specified for the following ct commands: - list - update - delete - get (these two commands below do not support for -f though, but in case this is extended in the future to support it): - flush - event The existing code that parses IPv4 and IPv6 addresses already infers the family, which simplifies the introduction of this update. The expect commands are not updated, they still require many mandatory options for filtering. This patch includes a few test updates too. Based on patch from Mikhail Sennikovsky. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix zone sync issueYi Yang2020-10-202-0/+8
| | | | | | | | | In some use cases, zone is used to differentiate different conntrack state tables, so zone also should be synchronized if it is set. Signed-off-by: Yi Yang <yangyi01@inspur.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CLASH_RESOLVED counterFlorian Westphal2020-08-251-3/+14
| | | | | | | | | | While at it, also allow to display up to 4 counters that are sent by kernel but that we do not know. This is useful to list counters that a new kernel supports with and older release of conntrack-tools. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add support for the IPS_HW_OFFLOAD flagPablo Neira Ayuso2020-04-281-2/+2
| | | | | | | This patch adds support for the IPS_HW_OFFLOAD flag which specifies that this conntrack entry has been offloaded into the hardware. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* helpers: Fix for warning when compiling against libtirpcPhil Sutter2019-11-121-3/+4
| | | | | | | | | | | | | | | | | Fix for the following warning: In file included from rpc.c:29: /usr/include/tirpc/rpc/rpc_msg.h:214:52: warning: 'struct rpc_err' declared inside parameter list will not be visible outside of this definition or declaration 214 | extern void _seterr_reply(struct rpc_msg *, struct rpc_err *); | ^~~~~~~ Struct rpc_err is declared in rpc/clnt.h which also declares rpc_call(), therefore rename the local version. Fixes: 5ededc4476f27 ("conntrackd: search for RPC headers") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Makefile.am: Use ${} instead of @...@Phil Sutter2019-11-122-3/+3
| | | | | | | | | | Referencing to variables using @...@ means they will be replaced by configure. This is not needed and may cause problems later. Suggested-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: UDP IPv6 destination address not usable (Bug 1378)Jan-Martin Raemer2019-11-071-1/+1
| | | | | | | | | | | As reported in https://bugzilla.netfilter.org/show_bug.cgi?id=1378, conntrackd refuses to start with a valid IPv6_Destination_Address, reporting "inet_pton(): IPv6 unsupported" due to a forgotten handling of err > 0 (i.e. success). This patch fixes the issue. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1378 Signed-off-by: Jan-Martin Raemer <raemer@zit-rlp.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: incorrect filtering of Address with cidr /0Pablo Neira Ayuso2019-09-301-3/+9
| | | | | | Set an all zero mask when cidr /0 is specified. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: Fix "Address Accept" filter caseRobin Geuze2019-09-301-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes a bug in the Address Accept filter case where if you only specify either addresses or masks it would never match, eg. Filter From Usespace { Address Accept { IPv4_address 127.0.0.1 } } or Filter From Usespace { Address Accept { IPv4_address 0.0.0.0/0 } } If lpm filter fails, fall back to hashtable lookup for exact matching. If lpm filter succeeds, then depending on the policy, skip hashtable lookup (in case policy is accept) or return mismatch (in case policy is ignore). Signed-off-by: Robin Geuze <robing@transip.nl> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: helper: Fix NFCTH_ATTR_PROTO_L4NUM sizePhil Sutter2019-09-101-1/+1
| | | | | | | | | | | | Kernel defines NFCTH_TUPLE_L4PROTONUM as of type NLA_U8. When adding a helper, NFCTH_ATTR_PROTO_L4NUM attribute is correctly set using nfct_helper_attr_set_u8(), though when deleting nfct_helper_attr_set_u32() was incorrectly used. Due to alignment, this causes trouble only on Big Endian. Fixes: 5e8f64f46cb1d ("conntrackd: add cthelper infrastructure (+ example FTP helper)") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Fix CIDR to mask conversion on Big EndianPhil Sutter2019-09-041-1/+1
| | | | | | | | | | Code assumed host architecture to be Little Endian. Instead produce a proper mask by pushing the set bits into most significant position and apply htonl() on the result. Fixes: 3f6a2e90936bb ("conntrack: add support for CIDR notation") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix strncpy -Wstringop-truncation warningsJose M. Guisado Gomez2019-08-172-14/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -Wstringop-truncation warning was introduced in GCC-8 as truncation checker for strncpy and strncat. Systems using gcc version >= 8 would receive the following warnings: read_config_yy.c: In function ‘yyparse’: read_config_yy.y:1594:2: warning: ‘strncpy’ specified bound 16 equals destination size [-Wstringop-truncation] 1594 | strncpy(policy->name, $2, CTD_HELPER_NAME_LEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ read_config_yy.y:1384:2: warning: ‘strncpy’ specified bound 256 equals destination size [-Wstringop-truncation] 1384 | strncpy(conf.stats.logfile, $2, FILENAME_MAXLEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ read_config_yy.y:692:2: warning: ‘strncpy’ specified bound 108 equals destination size [-Wstringop-truncation] 692 | strncpy(conf.local.path, $2, UNIX_PATH_MAX); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ read_config_yy.y:169:2: warning: ‘strncpy’ specified bound 256 equals destination size [-Wstringop-truncation] 169 | strncpy(conf.lockfile, $2, FILENAME_MAXLEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ read_config_yy.y:119:2: warning: ‘strncpy’ specified bound 256 equals destination size [-Wstringop-truncation] 119 | strncpy(conf.logfile, $2, FILENAME_MAXLEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ main.c: In function ‘main’: main.c:168:5: warning: ‘strncpy’ specified bound 4096 equals destination size [-Wstringop-truncation] 168 | strncpy(config_file, argv[i], PATH_MAX); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix the issue by checking for string length first. Also using snprintf instead. In addition, correct an off-by-one when warning about maximum config file path length. Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>