]> git.ipfire.org Git - thirdparty/iptables.git/commit
connlabel: Allow numeric labels even if connlabel.conf exists
authorPhil Sutter <phil@nwl.cc>
Wed, 4 Mar 2020 01:43:27 +0000 (02:43 +0100)
committerPhil Sutter <phil@nwl.cc>
Fri, 6 Mar 2020 15:48:28 +0000 (16:48 +0100)
commitf56d91bd80f0e86aaad56a32ddc84f373bb80745
tree2371a783eb9f0c32dba25a64fb6f02df67a586ce
parentd0446ab11182f6ca2adc486a124895f09a220c6e
connlabel: Allow numeric labels even if connlabel.conf exists

Existing code is a bit quirky: If no connlabel.conf was found, the local
function connlabel_value_parse() is called which tries to interpret
given label as a number. If the config exists though,
nfct_labelmap_get_bit() is called instead which doesn't care about
"undefined" connlabel names. So unless installed connlabel.conf contains
entries for all possible numeric labels, rules added by users may stop
working if a connlabel.conf is created.

Related man page snippet states: "Using a number always overrides
connlabel.conf", so try numeric parsing and fall back to nfct only if
that failed.

Fixes: 51340f7b6a110 ("extensions: libxt_connlabel: use libnetfilter_conntrack")
Fixes: 3a3bb480a738a ("extensions: connlabel: Fallback on missing connlabel.conf")
Signed-off-by: Phil Sutter <phil@nwl.cc>
extensions/libxt_connlabel.c