path: root/src/conntrack/labels.c
Commit message (Collapse)AuthorAgeFilesLines
* labels: don't crash on NULL labelmapMarcos Paulo de Souza2017-07-251-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When CONNLABEL_CFG isn't available (/etc/xtables/connlabel.conf), conntrack tool crashes: [marcos@Icarus ~]$ conntrack -l something nfct_labelmap_new: No such file or directory Segmentation fault (core dumped) I can see this problem in Fedora 26, because connlabel.conf does not come along the conntrack/libnetfilter packages. This problem happens because conntrack calls nfct_labelmap_new, which resides on libnetfilter_conntrack. So this lib returns NULL because CONNLABEL_CFG is not present, and then NULL is assigned to the global var called labelmap on conntrack. Later, get_label is called, passing NULL to the library, and __label_get_bit is called and deferences labelmap without check, which leads to a crash. With this patch the crash does not happen anymore, and an error message is displayed: conntrack -l something nfct_labelmap_new: No such file or directory conntrack v1.4.4 (conntrack-tools): unknown label 'something' Signed-off-by: Marcos Paulo de Souza <> Signed-off-by: Florian Westphal <>
* conntrack: labels: add function to fetch default config file locationFlorian Westphal2016-08-081-0/+5
| | | | | | Suggested-by: Pablo Neira Ayuso <> Signed-off-by: Florian Westphal <> Acked-by: Pablo Neira Ayuso <>
* conntrack: labels: remove dead codeFlorian Westphal2014-02-181-1/+1
| | | | | | unsigned, < 0 is always false. Signed-off-by: Florian Westphal <>
* conntrack: labels: labelmap_new: make sure errno is 0 when no labels are foundFlorian Westphal2013-07-111-1/+3
| | | | | | | | | | | | | | nfct_labelmap_new returns NULL on failure, e.g. when file cannot be opened. It will also fail if no labels have been parsed, and in this case, content of errno is random. Avoid it by making sure that errno is re-set when no labels were found. While at it, also change ptr test when parsing so reviewers don't need to triple check that this cannot result in out-of-bounds read. Reported-by: Afschin Hormozdiary <> Signed-off-by: Florian Westphal <>
* conntrack: labels: skip labels with non-alnum charactersFlorian Westphal2013-06-301-1/+27
| | | | | | | | | | | | Can always lift this restriction later but for now enforce strict label naming. This is mainly to make sure that e.g. using conntrack ... -o xml,connlabels will output the expected format, without nasty surprises. Signed-off-by: Florian Westphal <>
* connlabel: fix NULL deref on malloc failureFlorian Westphal2013-06-061-1/+1
| | | | Signed-off-by: Florian Westphal <>
* api: add connlabel api and attributeFlorian Westphal2013-05-061-0/+243
adds new labelmap api to create a name <-> bit mapping from a text file (default: /etc/xtables/connlabel.conf). nfct_labelmap_new(filename) is used to create the map, nfct_labelmap_destroy() releases the resources allocated for the map. Two functions are added to make map lookups: nfct_labelmap_get_name(map, bit) returns the name of a bit, nfct_labelmap_get_bit returns the bit associated with a name. The connlabel attribute is represented by a nfct_bitmask object, the nfct_bitmask api can be used to test/set/get individual bits ("labels"). The exisiting nfct_attr_get/set interfaces can be used to read or replace the existing labels associated with a conntrack with a new set. Signed-off-by: Florian Westphal <>