Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1cae565e authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: limit maximum table name length to 32 bytes 



Set the same as we use for chain names, it should be enough.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f04e599e

include/net/netfilter/nf_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -535,7 +535,7 @@ struct nft_table { 
	u64				hgenerator;

	u32				use;

	u16				flags;

	char				name[];

	char				name[NFT_TABLE_MAXNAMELEN];

};



/**

include/uapi/linux/netfilter/nf_tables.h

+1 −0
Original line number Diff line number Diff line 
#ifndef _LINUX_NF_TABLES_H

#define _LINUX_NF_TABLES_H



#define NFT_TABLE_MAXNAMELEN	32

#define NFT_CHAIN_MAXNAMELEN	32

#define NFT_USERDATA_MAXLEN	256

net/netfilter/nf_tables_api.c

+4 −3
Original line number Diff line number Diff line
@@ -401,7 +401,8 @@ nf_tables_chain_type_lookup(const struct nft_af_info *afi, 
}



static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {

	[NFTA_TABLE_NAME]	= { .type = NLA_STRING },

	[NFTA_TABLE_NAME]	= { .type = NLA_STRING,

				    .len = NFT_TABLE_MAXNAMELEN - 1 },

	[NFTA_TABLE_FLAGS]	= { .type = NLA_U32 },

};
@@ -686,13 +687,13 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb, 
	if (!try_module_get(afi->owner))

		return -EAFNOSUPPORT;



	table = kzalloc(sizeof(*table) + nla_len(name), GFP_KERNEL);

	table = kzalloc(sizeof(*table), GFP_KERNEL);

	if (table == NULL) {

		module_put(afi->owner);

		return -ENOMEM;

	}



	nla_strlcpy(table->name, name, nla_len(name));

	nla_strlcpy(table->name, name, NFT_TABLE_MAXNAMELEN);

	INIT_LIST_HEAD(&table->chains);

	INIT_LIST_HEAD(&table->sets);

	table->flags = flags;