diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-03-24 15:10:37 +0100 |
|---|---|---|
| committer | Show Liu <show.liu@linaro.org> | 2014-06-18 12:03:36 +0800 |
| commit | a93af797fa7c0006d22363b1f398e43a09a8f7b7 (patch) | |
| tree | 64e341556fcdc6315b4cf36a13788f5d39232839 /net/netfilter/nf_tables_api.c | |
| parent | 9aa0b71e48c0f6f290dbc6c18328618e9d3cbef4 (diff) | |
netfilter: nf_tables: set names cannot be larger than 15 bytes
commit a9bdd8365684810e3de804f8c51e52c26a5eccbb upstream.
Currently, nf_tables trims off the set name if it exceeeds 15
bytes, so explicitly reject set names that are too large.
Reported-by: Giuseppe Longo <giuseppelng@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/netfilter/nf_tables_api.c')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index adce01e8bb5..c68e5e0628d 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1934,7 +1934,8 @@ static const struct nft_set_ops *nft_select_set_ops(const struct nlattr * const static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { [NFTA_SET_TABLE] = { .type = NLA_STRING }, - [NFTA_SET_NAME] = { .type = NLA_STRING }, + [NFTA_SET_NAME] = { .type = NLA_STRING, + .len = IFNAMSIZ - 1 }, [NFTA_SET_FLAGS] = { .type = NLA_U32 }, [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, |