Commit 38745490 authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso

netfilter: nf_tables: Allow set names of up to 255 chars

Same conversion as for table names, use NFT_NAME_MAXLEN as upper
boundary as well.
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b7263e07
...@@ -396,7 +396,7 @@ void nft_unregister_set(struct nft_set_type *type); ...@@ -396,7 +396,7 @@ void nft_unregister_set(struct nft_set_type *type);
struct nft_set { struct nft_set {
struct list_head list; struct list_head list;
struct list_head bindings; struct list_head bindings;
char name[NFT_SET_MAXNAMELEN]; char *name;
u32 ktype; u32 ktype;
u32 dtype; u32 dtype;
u32 objtype; u32 objtype;
......
...@@ -4,7 +4,7 @@ ...@@ -4,7 +4,7 @@
#define NFT_NAME_MAXLEN 256 #define NFT_NAME_MAXLEN 256
#define NFT_TABLE_MAXNAMELEN NFT_NAME_MAXLEN #define NFT_TABLE_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_CHAIN_MAXNAMELEN NFT_NAME_MAXLEN #define NFT_CHAIN_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_SET_MAXNAMELEN 32 #define NFT_SET_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_OBJ_MAXNAMELEN 32 #define NFT_OBJ_MAXNAMELEN 32
#define NFT_USERDATA_MAXLEN 256 #define NFT_USERDATA_MAXLEN 256
......
...@@ -2650,7 +2650,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, ...@@ -2650,7 +2650,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
unsigned long *inuse; unsigned long *inuse;
unsigned int n = 0, min = 0; unsigned int n = 0, min = 0;
p = strnchr(name, NFT_SET_MAXNAMELEN, '%'); p = strchr(name, '%');
if (p != NULL) { if (p != NULL) {
if (p[1] != 'd' || strchr(p + 2, '%')) if (p[1] != 'd' || strchr(p + 2, '%'))
return -EINVAL; return -EINVAL;
...@@ -2681,7 +2681,10 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, ...@@ -2681,7 +2681,10 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
free_page((unsigned long)inuse); free_page((unsigned long)inuse);
} }
snprintf(set->name, sizeof(set->name), name, min + n); set->name = kasprintf(GFP_KERNEL, name, min + n);
if (!set->name)
return -ENOMEM;
list_for_each_entry(i, &ctx->table->sets, list) { list_for_each_entry(i, &ctx->table->sets, list) {
if (!nft_is_active_next(ctx->net, i)) if (!nft_is_active_next(ctx->net, i))
continue; continue;
...@@ -2958,7 +2961,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, ...@@ -2958,7 +2961,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
struct nft_table *table; struct nft_table *table;
struct nft_set *set; struct nft_set *set;
struct nft_ctx ctx; struct nft_ctx ctx;
char name[NFT_SET_MAXNAMELEN]; char *name;
unsigned int size; unsigned int size;
bool create; bool create;
u64 timeout; u64 timeout;
...@@ -3104,8 +3107,14 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, ...@@ -3104,8 +3107,14 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
goto err1; goto err1;
} }
nla_strlcpy(name, nla[NFTA_SET_NAME], sizeof(set->name)); name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
if (!name) {
err = -ENOMEM;
goto err2;
}
err = nf_tables_set_alloc_name(&ctx, set, name); err = nf_tables_set_alloc_name(&ctx, set, name);
kfree(name);
if (err < 0) if (err < 0)
goto err2; goto err2;
...@@ -3155,6 +3164,7 @@ static void nft_set_destroy(struct nft_set *set) ...@@ -3155,6 +3164,7 @@ static void nft_set_destroy(struct nft_set *set)
{ {
set->ops->destroy(set); set->ops->destroy(set);
module_put(set->ops->type->owner); module_put(set->ops->type->owner);
kfree(set->name);
kvfree(set); kvfree(set);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment