diff options
| author | Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> | 2022-06-24 17:01:25 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-06-27 12:03:13 +0200 |
| commit | 9d5278391f0dd8e9e7390a5280979ccc40b502b8 (patch) | |
| tree | 20506da7a89d15cfcbbe8efddd2aa7115796dc64 /src/conntrack.c | |
| parent | 5b1f4ea66afbf1bb20ec4c2de06bb5d8ae0a27cd (diff) | |
conntrack: fix protocol number parsing
Before this commit it was possible to successfully create a ct entry
passing -p 256 and -p some_nonsense.
In both cases an entry with the protocol=0 would be created.
Do not allow invalid protocol values to -p option.
Include testcases covering the issue.
Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/conntrack.c')
| -rw-r--r-- | src/conntrack.c | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/src/conntrack.c b/src/conntrack.c index 500e736..e381543 100644 --- a/src/conntrack.c +++ b/src/conntrack.c @@ -882,6 +882,21 @@ static int ct_save_snprintf(char *buf, size_t len, extern struct ctproto_handler ct_proto_unknown; +static int parse_proto_num(const char *str) +{ + char *endptr; + long val; + + val = strtol(str, &endptr, 0); + if (val >= IPPROTO_MAX || + val < 0 || + endptr == str || + *endptr != '\0') + return -1; + + return val; +} + static struct ctproto_handler *findproto(char *name, int *pnum) { struct ctproto_handler *cur; @@ -901,8 +916,8 @@ static struct ctproto_handler *findproto(char *name, int *pnum) return &ct_proto_unknown; } /* using a protocol number? */ - protonum = atoi(name); - if (protonum >= 0 && protonum <= IPPROTO_MAX) { + protonum = parse_proto_num(name); + if (protonum >= 0) { /* try lookup by number, perhaps this protocol is supported */ list_for_each_entry(cur, &proto_list, head) { if (cur->protonum == protonum) { |