From 3684a1b69c255d5268dd2b1590c1dc039e48052d Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Fri, 18 Aug 2023 11:40:37 +0200 Subject: src: add input flag NFT_CTX_INPUT_NO_DNS to avoid blocking getaddrinfo() blocks while trying to resolve the name. Blocking the caller of the library is in many cases undesirable. Also, while reconfiguring the firewall, it's not clear that resolving names via the network will work or makes sense. Add a new input flag NFT_CTX_INPUT_NO_DNS to opt-out from getaddrinfo() and only accept plain IP addresses. We could also use AI_NUMERICHOST with getaddrinfo() instead of inet_pton(). By parsing via inet_pton(), we are better aware of what we expect and can generate a better error message in case of failure. Signed-off-by: Thomas Haller Reviewed-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- include/datatype.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/datatype.h') diff --git a/include/datatype.h b/include/datatype.h index 4b59790b..be5c6d1b 100644 --- a/include/datatype.h +++ b/include/datatype.h @@ -182,6 +182,7 @@ struct datatype *dtype_clone(const struct datatype *orig_dtype); struct parse_ctx { struct symbol_tables *tbl; + const struct input_ctx *input; }; extern struct error_record *symbol_parse(struct parse_ctx *ctx, -- cgit v1.2.3