netfilter: nf_tables: Allow chain name of up to 255 chars

Same conversion as for table names, use NFT_NAME_MAXLEN as upper boundary as well.

Phil Sutter committed 9 years ago

Commit b7263e01 parent e46abbc4 files · +54 −13Browse files

Unified · Split

4 files

include/net/netfilter/nf_tables.h +2 −2
include/uapi/linux/netfilter/nf_tables.h +1 −1
net/netfilter/nf_tables_api.c +26 −8
net/netfilter/nf_tables_trace.c +25 −2

@@ -859,7 +859,7 @@ struct nft_chain { · 858 unmodified lines
859	u16 level;	859	u16 level;
860	u8 flags:6,	860	u8 flags:6,
861	genmask:2;	861	genmask:2;
862	char name[NFT_CHAIN_MAXNAMELEN];	862	char *name;
863	};	863	};
864		864
865	enum nft_chain_type {	865	enum nft_chain_type {
@@ -1272,7 +1272,7 @@ struct nft_trans_set { · 406 unmodified lines
1272		1272
1273	struct nft_trans_chain {	1273	struct nft_trans_chain {
1274	bool update;	1274	bool update;
1275	char name[NFT_CHAIN_MAXNAMELEN];	1275	char *name;
1276	struct nft_stats __percpu *stats;	1276	struct nft_stats __percpu *stats;
1277	u8 policy;	1277	u8 policy;
1278	};	1278	};

include/uapi/linux/netfilter/nf_tables.h+1−1

@@ -3,7 +3,7 @@ · 2 unmodified lines
3		3
4	#define NFT_NAME_MAXLEN 256	4	#define NFT_NAME_MAXLEN 256
5	#define NFT_TABLE_MAXNAMELEN NFT_NAME_MAXLEN	5	#define NFT_TABLE_MAXNAMELEN NFT_NAME_MAXLEN
6	#define NFT_CHAIN_MAXNAMELEN 32	6	#define NFT_CHAIN_MAXNAMELEN NFT_NAME_MAXLEN
7	#define NFT_SET_MAXNAMELEN 32	7	#define NFT_SET_MAXNAMELEN 32
8	#define NFT_OBJ_MAXNAMELEN 32	8	#define NFT_OBJ_MAXNAMELEN 32
9	#define NFT_USERDATA_MAXLEN 256	9	#define NFT_USERDATA_MAXLEN 256

net/netfilter/nf_tables_api.c+26−8

 			static_branch_dec(&nft_counters_enabled);
 		if (basechain->ops[0].dev != NULL)
 			dev_put(basechain->ops[0].dev);
+		kfree(chain->name);
 		kfree(basechain);
 	} else {
+		kfree(chain->name);
 		kfree(chain);
 	}
 }
 			nft_trans_chain_policy(trans) = -1;
 		if (nla[NFTA_CHAIN_HANDLE] && name) {
-			nla_strlcpy(nft_trans_chain_name(trans), name,
+			nft_trans_chain_name(trans) =
-				    NFT_CHAIN_MAXNAMELEN);
+				nla_strdup(name, GFP_KERNEL);
+			if (!nft_trans_chain_name(trans)) {
+				kfree(trans);
+				free_percpu(stats);
+				return -ENOMEM;
+			}
 		}
 		list_add_tail(&trans->list, &net->nft.commit_list);
 		return 0;
 	INIT_LIST_HEAD(&chain->rules);
 	chain->handle = nf_tables_alloc_handle(table);
 	chain->table = table;
-	nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
+	chain->name = nla_strdup(name, GFP_KERNEL);
+	if (!chain->name) {
+		err = -ENOMEM;
+		goto err1;
+	}
 	err = nf_tables_register_hooks(net, table, chain, afi->nops);
 	if (err < 0)
 struct nft_rule_dump_ctx {
 	char *table;
-	char chain[NFT_CHAIN_MAXNAMELEN];
+	char *chain;
 };
 static int nf_tables_dump_rules(struct sk_buff *skb,
 	if (ctx) {
 		kfree(ctx->table);
+		kfree(ctx->chain);
 		kfree(ctx);
 	}
 	return 0;
 					return -ENOMEM;
 				}
 			}
-			if (nla[NFTA_RULE_CHAIN])
+			if (nla[NFTA_RULE_CHAIN]) {
-				nla_strlcpy(ctx->chain, nla[NFTA_RULE_CHAIN],
+				ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
-					    sizeof(ctx->chain));
+							GFP_KERNEL);
+				if (!ctx->chain) {
+					kfree(ctx->table);
+					kfree(ctx);
+					return -ENOMEM;
+				}
+			}
 			c.data = ctx;
 		}
 {
 	struct nft_base_chain *basechain;
-	if (nft_trans_chain_name(trans)[0])
+	if (nft_trans_chain_name(trans))
 		strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
 	if (!nft_is_base_chain(trans->ctx.chain))

net/netfilter/nf_tables_trace.c+25−2

 			    NFTA_TRACE_PAD);
 }
+static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info)
+{
+	switch (info->type) {
+	case NFT_TRACETYPE_RETURN:
+	case NFT_TRACETYPE_RULE:
+		break;
+	default:
+		return false;
+	}
+	switch (info->verdict->code) {
+	case NFT_JUMP:
+	case NFT_GOTO:
+		break;
+	default:
+		return false;
+	}
+	return true;
+}
 void nft_trace_notify(struct nft_traceinfo *info)
 {
 	const struct nft_pktinfo *pkt = info->pkt;
 	size = nlmsg_total_size(sizeof(struct nfgenmsg)) +
 		nla_total_size(strlen(info->chain->table->name)) +
-		nla_total_size(NFT_CHAIN_MAXNAMELEN) +
+		nla_total_size(strlen(info->chain->name)) +
 		nla_total_size_64bit(sizeof(__be64)) +	/* rule handle */
 		nla_total_size(sizeof(__be32)) +	/* trace type */
 		nla_total_size(0) +			/* VERDICT, nested */
 			nla_total_size(sizeof(u32)) +	/* verdict code */
-			nla_total_size(NFT_CHAIN_MAXNAMELEN) + /* jump target */
 		nla_total_size(sizeof(u32)) +		/* id */
 		nla_total_size(NFT_TRACETYPE_LL_HSIZE) +
 		nla_total_size(NFT_TRACETYPE_NETWORK_HSIZE) +
 		nla_total_size(sizeof(u32)) +		/* nfproto */
 		nla_total_size(sizeof(u32));		/* policy */
+	if (nft_trace_have_verdict_chain(info))
+		size += nla_total_size(strlen(info->verdict->chain->name)); /* jump target */
 	skb = nlmsg_new(size, GFP_ATOMIC);
 	if (!skb)
 		return;