diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-12-23 15:49:36 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-12-23 15:53:08 +0100 |
| commit | 8b837716369724287f768531b813501c4ba80f38 (patch) | |
| tree | ad7c279fd9a8eb77080c7e0b3f8bebc78d2df88e /src/conntrack.c | |
| parent | f6ca2166405e5f24b5c8c34319792e49b5857923 (diff) | |
conntrack: send mark filter to kernel iff set
Do not set a mark filter to ctnetlink if the user doesn't explicitly
specify this.
Fixes: aa925010951e ("conntrack: allow to filter by mark from kernel-space")
Reported-by: Joseph Conley <joseph.j.conley@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/conntrack.c')
| -rw-r--r-- | src/conntrack.c | 28 |
1 files changed, 18 insertions, 10 deletions
diff --git a/src/conntrack.c b/src/conntrack.c index ff030fe..682afa6 100644 --- a/src/conntrack.c +++ b/src/conntrack.c @@ -79,6 +79,7 @@ static struct { /* Allow to filter by mark from kernel-space. */ struct nfct_filter_dump_mark filter_mark_kernel; + bool filter_mark_kernel_set; /* Allows filtering by ctlabels */ struct nfct_bitmask *label; @@ -2374,6 +2375,7 @@ int main(int argc, char *argv[]) parse_u32_mask(optarg, &tmpl.mark); tmpl.filter_mark_kernel.val = tmpl.mark.value; tmpl.filter_mark_kernel.mask = tmpl.mark.mask; + tmpl.filter_mark_kernel_set = true; break; case 'l': case '<': @@ -2523,11 +2525,14 @@ int main(int argc, char *argv[]) if (filter_dump == NULL) exit_error(OTHER_PROBLEM, "OOM"); - nfct_filter_dump_set_attr(filter_dump, NFCT_FILTER_DUMP_MARK, - &tmpl.filter_mark_kernel); - nfct_filter_dump_set_attr_u8(filter_dump, - NFCT_FILTER_DUMP_L3NUM, - family); + if (tmpl.filter_mark_kernel_set) { + nfct_filter_dump_set_attr(filter_dump, + NFCT_FILTER_DUMP_MARK, + &tmpl.filter_mark_kernel); + nfct_filter_dump_set_attr_u8(filter_dump, + NFCT_FILTER_DUMP_L3NUM, + family); + } if (options & CT_OPT_ZERO) res = nfct_query(cth, NFCT_Q_DUMP_FILTER_RESET, @@ -2626,11 +2631,14 @@ int main(int argc, char *argv[]) if (filter_dump == NULL) exit_error(OTHER_PROBLEM, "OOM"); - nfct_filter_dump_set_attr(filter_dump, NFCT_FILTER_DUMP_MARK, - &tmpl.filter_mark_kernel); - nfct_filter_dump_set_attr_u8(filter_dump, - NFCT_FILTER_DUMP_L3NUM, - family); + if (tmpl.filter_mark_kernel_set) { + nfct_filter_dump_set_attr(filter_dump, + NFCT_FILTER_DUMP_MARK, + &tmpl.filter_mark_kernel); + nfct_filter_dump_set_attr_u8(filter_dump, + NFCT_FILTER_DUMP_L3NUM, + family); + } res = nfct_query(cth, NFCT_Q_DUMP_FILTER, filter_dump); |