• Liping Zhang's avatar
    netfilter: nf_tables: validate the name size when possible · b2fbd044
    Liping Zhang authored
    Currently, if the user add a stateful object with the name size exceed
    NFT_OBJ_MAXNAMELEN - 1 (i.e. 31), we truncate it down to 31 silently.
    This is not friendly, furthermore, this will cause duplicated stateful
    objects when the first 31 characters of the name is same. So limit the
    stateful object's name size to NFT_OBJ_MAXNAMELEN - 1.
    
    After apply this patch, error message will be printed out like this:
      # name_32=$(printf "%0.sQ" {1..32})
      # nft add counter filter $name_32
      <cmdline>:1:1-52: Error: Could not process rule: Numerical result out
      of range
      add counter filter QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    
    Also this patch cleans up the codes which missing the name size limit
    validation in nftables.
    
    Fixes: e5009240 ("netfilter: nf_tables: add stateful objects")
    Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    b2fbd044
nft_objref.c 5.78 KB