path: root/iptables/nft-cache.c
diff options
authorPhil Sutter <>2020-03-04 02:43:27 +0100
committerPhil Sutter <>2020-03-06 16:48:28 +0100
commitf56d91bd80f0e86aaad56a32ddc84f373bb80745 (patch)
tree2371a783eb9f0c32dba25a64fb6f02df67a586ce /iptables/nft-cache.c
parentd0446ab11182f6ca2adc486a124895f09a220c6e (diff)
connlabel: Allow numeric labels even if connlabel.conf exists
Existing code is a bit quirky: If no connlabel.conf was found, the local function connlabel_value_parse() is called which tries to interpret given label as a number. If the config exists though, nfct_labelmap_get_bit() is called instead which doesn't care about "undefined" connlabel names. So unless installed connlabel.conf contains entries for all possible numeric labels, rules added by users may stop working if a connlabel.conf is created. Related man page snippet states: "Using a number always overrides connlabel.conf", so try numeric parsing and fall back to nfct only if that failed. Fixes: 51340f7b6a110 ("extensions: libxt_connlabel: use libnetfilter_conntrack") Fixes: 3a3bb480a738a ("extensions: connlabel: Fallback on missing connlabel.conf") Signed-off-by: Phil Sutter <>
Diffstat (limited to 'iptables/nft-cache.c')
0 files changed, 0 insertions, 0 deletions