Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 38745490 authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: Allow set names of up to 255 chars 



Same conversion as for table names, use NFT_NAME_MAXLEN as upper
boundary as well.

Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b7263e07

include/net/netfilter/nf_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -396,7 +396,7 @@ void nft_unregister_set(struct nft_set_type *type); 
struct nft_set {

	struct list_head		list;

	struct list_head		bindings;

	char				name[NFT_SET_MAXNAMELEN];

	char				*name;

	u32				ktype;

	u32				dtype;

	u32				objtype;

include/uapi/linux/netfilter/nf_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ 
#define NFT_NAME_MAXLEN		256

#define NFT_TABLE_MAXNAMELEN	NFT_NAME_MAXLEN

#define NFT_CHAIN_MAXNAMELEN	NFT_NAME_MAXLEN

#define NFT_SET_MAXNAMELEN	32

#define NFT_SET_MAXNAMELEN	NFT_NAME_MAXLEN

#define NFT_OBJ_MAXNAMELEN	32

#define NFT_USERDATA_MAXLEN	256

net/netfilter/nf_tables_api.c

+14 −4
Original line number Diff line number Diff line
@@ -2650,7 +2650,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 
	unsigned long *inuse;

	unsigned int n = 0, min = 0;



	p = strnchr(name, NFT_SET_MAXNAMELEN, '%');

	p = strchr(name, '%');

	if (p != NULL) {

		if (p[1] != 'd' || strchr(p + 2, '%'))

			return -EINVAL;
@@ -2681,7 +2681,10 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 
		free_page((unsigned long)inuse);

	}



	snprintf(set->name, sizeof(set->name), name, min + n);

	set->name = kasprintf(GFP_KERNEL, name, min + n);

	if (!set->name)

		return -ENOMEM;



	list_for_each_entry(i, &ctx->table->sets, list) {

		if (!nft_is_active_next(ctx->net, i))

			continue;
@@ -2958,7 +2961,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, 
	struct nft_table *table;

	struct nft_set *set;

	struct nft_ctx ctx;

	char name[NFT_SET_MAXNAMELEN];

	char *name;

	unsigned int size;

	bool create;

	u64 timeout;
@@ -3104,8 +3107,14 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, 
		goto err1;

	}



	nla_strlcpy(name, nla[NFTA_SET_NAME], sizeof(set->name));

	name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);

	if (!name) {

		err = -ENOMEM;

		goto err2;

	}



	err = nf_tables_set_alloc_name(&ctx, set, name);

	kfree(name);

	if (err < 0)

		goto err2;
@@ -3155,6 +3164,7 @@ static void nft_set_destroy(struct nft_set *set) 
{

	set->ops->destroy(set);

	module_put(set->ops->type->owner);

	kfree(set->name);

	kvfree(set);

}