From 3b620faee61fc9d356ca323ad6c8fe50b8b2b697 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 24 Jan 2024 21:42:06 +0100 Subject: conntrack: api: bail out if setting up filter for flush/dump fails Instead of asserting or simply ignoring the filter, bail out if setting up filter fails. Fixes: c2136262802f ("Adding NFCT_FILTER_DUMP_TUPLE in filter_dump_attr, using kernel CTA_FILTER API") Signed-off-by: Pablo Neira Ayuso --- src/conntrack/api.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/conntrack/api.c') diff --git a/src/conntrack/api.c b/src/conntrack/api.c index 60c87b3..22965f1 100644 --- a/src/conntrack/api.c +++ b/src/conntrack/api.c @@ -850,12 +850,14 @@ __build_query_ct(struct nfnl_subsys_handle *ssh, case NFCT_Q_DUMP_FILTER: nfct_fill_hdr(req, IPCTNL_MSG_CT_GET, NLM_F_DUMP, AF_UNSPEC, NFNETLINK_V0); - assert(__build_filter_dump(req, size, data) == 0); + if (__build_filter_dump(req, size, data) < 0) + return -1; break; case NFCT_Q_DUMP_FILTER_RESET: nfct_fill_hdr(req, IPCTNL_MSG_CT_GET_CTRZERO, NLM_F_DUMP, AF_UNSPEC, NFNETLINK_V0); - __build_filter_dump(req, size, data); + if (__build_filter_dump(req, size, data) < 0) + return -1; break; default: errno = ENOTSUP; -- cgit v1.2.3