History

netfilter: nf_tables: validate the name size when possible

Currently, if the user add a stateful object with the name size exceed NFT_OBJ_MAXNAMELEN - 1 (i.e. 31), we truncate it down to 31 silently. This is not friendly, furthermore, this will cause duplicated stateful objects when the first 31 characters of the name is same. So limit the stateful object's name size to NFT_OBJ_MAXNAMELEN - 1. After apply this patch, error message will be printed out like this: # name_32=$(printf "%0.sQ" {1..32}) # nft add counter filter $name_32 <cmdline>:1:1-52: Error: Could not process rule: Numerical result out of range add counter filter QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Also this patch cleans up the codes which missing the name size limit validation in nftables.

Liping Zhang committed 9 years ago

Commit b2fbd041 parent e5072054 files · +22 −11Browse files

Unified · Split

4 files
  1. net/netfilter/nf_tables_api.c +14 −7
  2. net/netfilter/nft_dynset.c +2 −1
  3. net/netfilter/nft_lookup.c +2 −1
  4. net/netfilter/nft_objref.c +4 −2
net/netfilter/nf_tables_api.c+14−7
@@ -928,7 +928,8 @@ static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table, · 927 unmodified lines
928}928}
929 929
930static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {930static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
931 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING },931 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
932 .len = NFT_TABLE_MAXNAMELEN - 1 },
932 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },933 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
933 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,934 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
934 .len = NFT_CHAIN_MAXNAMELEN - 1 },935 .len = NFT_CHAIN_MAXNAMELEN - 1 },
@@ -1854,7 +1855,8 @@ static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain, · 919 unmodified lines
1854}1855}
1855 1856
1856static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {1857static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
1857 [NFTA_RULE_TABLE] = { .type = NLA_STRING },1858 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1859 .len = NFT_TABLE_MAXNAMELEN - 1 },
1858 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,1860 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1859 .len = NFT_CHAIN_MAXNAMELEN - 1 },1861 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1860 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },1862 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
@@ -2443,7 +2445,8 @@ nft_select_set_ops(const struct nlattr * const nla[], · 582 unmodified lines
2443}2445}
2444 2446
2445static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {2447static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
2446 [NFTA_SET_TABLE] = { .type = NLA_STRING },2448 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2449 .len = NFT_TABLE_MAXNAMELEN - 1 },
2447 [NFTA_SET_NAME] = { .type = NLA_STRING,2450 [NFTA_SET_NAME] = { .type = NLA_STRING,
2448 .len = NFT_SET_MAXNAMELEN - 1 },2451 .len = NFT_SET_MAXNAMELEN - 1 },
2449 [NFTA_SET_FLAGS] = { .type = NLA_U32 },2452 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
@@ -3192,8 +3195,10 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { · 742 unmodified lines
3192};3195};
3193 3196
3194static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {3197static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
3195 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING },3198 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3196 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING },3199 .len = NFT_TABLE_MAXNAMELEN - 1 },
3200 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3201 .len = NFT_SET_MAXNAMELEN - 1 },
3197 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },3202 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
3198 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },3203 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
3199};3204};
@@ -4032,8 +4037,10 @@ struct nft_object *nf_tables_obj_lookup(const struct nft_table *table, · 832 unmodified lines
4032EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);4037EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
4033 4038
4034static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {4039static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
4035 [NFTA_OBJ_TABLE] = { .type = NLA_STRING },4040 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4036 [NFTA_OBJ_NAME] = { .type = NLA_STRING },4041 .len = NFT_TABLE_MAXNAMELEN - 1 },
4042 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4043 .len = NFT_OBJ_MAXNAMELEN - 1 },
4037 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },4044 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4038 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },4045 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4039};4046};
net/netfilter/nft_dynset.c+2−1
@@ -98,7 +98,8 @@ out: · 97 unmodified lines
98}98}
99 99
100static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = {100static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = {
101 [NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING },101 [NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING,
102 .len = NFT_SET_MAXNAMELEN - 1 },
102 [NFTA_DYNSET_SET_ID] = { .type = NLA_U32 },103 [NFTA_DYNSET_SET_ID] = { .type = NLA_U32 },
103 [NFTA_DYNSET_OP] = { .type = NLA_U32 },104 [NFTA_DYNSET_OP] = { .type = NLA_U32 },
104 [NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 },105 [NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 },
net/netfilter/nft_lookup.c+2−1
@@ -49,7 +49,8 @@ static void nft_lookup_eval(const struct nft_expr *expr, · 48 unmodified lines
49}49}
50 50
51static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {51static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
52 [NFTA_LOOKUP_SET] = { .type = NLA_STRING },52 [NFTA_LOOKUP_SET] = { .type = NLA_STRING,
53 .len = NFT_SET_MAXNAMELEN - 1 },
53 [NFTA_LOOKUP_SET_ID] = { .type = NLA_U32 },54 [NFTA_LOOKUP_SET_ID] = { .type = NLA_U32 },
54 [NFTA_LOOKUP_SREG] = { .type = NLA_U32 },55 [NFTA_LOOKUP_SREG] = { .type = NLA_U32 },
55 [NFTA_LOOKUP_DREG] = { .type = NLA_U32 },56 [NFTA_LOOKUP_DREG] = { .type = NLA_U32 },
net/netfilter/nft_objref.c+4−2
@@ -193,10 +193,12 @@ nft_objref_select_ops(const struct nft_ctx *ctx, · 192 unmodified lines
193}193}
194 194
195static const struct nla_policy nft_objref_policy[NFTA_OBJREF_MAX + 1] = {195static const struct nla_policy nft_objref_policy[NFTA_OBJREF_MAX + 1] = {
196 [NFTA_OBJREF_IMM_NAME] = { .type = NLA_STRING },196 [NFTA_OBJREF_IMM_NAME] = { .type = NLA_STRING,
197 .len = NFT_OBJ_MAXNAMELEN - 1 },
197 [NFTA_OBJREF_IMM_TYPE] = { .type = NLA_U32 },198 [NFTA_OBJREF_IMM_TYPE] = { .type = NLA_U32 },
198 [NFTA_OBJREF_SET_SREG] = { .type = NLA_U32 },199 [NFTA_OBJREF_SET_SREG] = { .type = NLA_U32 },
199 [NFTA_OBJREF_SET_NAME] = { .type = NLA_STRING },200 [NFTA_OBJREF_SET_NAME] = { .type = NLA_STRING,
201 .len = NFT_SET_MAXNAMELEN - 1 },
200 [NFTA_OBJREF_SET_ID] = { .type = NLA_U32 },202 [NFTA_OBJREF_SET_ID] = { .type = NLA_U32 },
201};203};
202 204