Re: nfnetlink/ctnetlink from pom-ng r3884

[Pablo Neira <pablo@eurodev.net>]

[-- Attachment #1: Type: text/plain, Size: 1284 bytes --]

Wang Jian wrote:
> type: [NEW] src=192.168.0.27 dst=192.168.0.254 sport=22 dport=2846 src=192.168.0.254 dst=192.168.0.27 sport=2846 dport=22 status:8 timeout:432000 tcp 6 orig_packets=1 orig_bytes=0, reply_packets=268 reply_bytes=0 
> type: [UPDATE] src=192.168.0.27 dst=192.168.0.254 sport=22 dport=2846 src=192.168.0.254 dst=192.168.0.27 sport=2846 dport=22 status:10 timeout:432000 orig_packets=1 orig_bytes=0, reply_packets=268 reply_bytes=0 
> orig_packets=1 orig_bytes=0, reply_packets=268 reply_bytes=0 
> 
> See the second event message. account information is printed twice, that
> means the netlink message has duplicated account information.

no, status flags has changed. The seen_reply bit has been set.

> And
> 
> # ./conntrack -E conntrack
> ...
> type: [UPDATE] src=192.168.0.254 dst=192.168.0.27 sport=4347 dport=22 src=192.168.0.27 dst=192.168.0.254 sport=22 dport=4347 timeout:120 tcp 6 orig_packets=5 orig_bytes=0, reply_packets=270 reply_bytes=0 
> type: [DESTROY] src=192.168.0.254 dst=192.168.0.27 sport=4347 dport=22 src=192.168.0.27 dst=192.168.0.254 sport=22 dport=4347 orig_packets=5 orig_bytes=0, reply_packets=270 reply_bytes=0 
> Segmentation fault (core dumped)
> 
> core dumps again. This time the backtrace is

The patch attached fixes it.

--
Pablo

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 383 bytes --]

Index: src/libct.c
===================================================================
--- src/libct.c	(revision 3881)
+++ src/libct.c	(working copy)
@@ -239,7 +239,7 @@
 			attr = NFA_NEXT(attr, attrlen);
 		}
 		min_len += nlh->nlmsg_len;
-		nlh = (struct nlmsghdr *) attr;
+		nlh = (struct nlmsghdr *) (nlh + nlh->nlmsg_len);
 		printf("\n");
 	}
 	DEBUGP("exit from handler\n");