Skip to content

Commit

Permalink
netfilter: nf_tables: allow set names up to 32 bytes
Browse files Browse the repository at this point in the history
Currently, we support set names of up to 16 bytes, get this aligned
with the maximum length we can use in ipset to make it easier when
considering migration to nf_tables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Pablo Neira Ayuso committed May 5, 2016
1 parent d7cdf81 commit cb39ad8
Showing 3 changed files with 5 additions and 4 deletions.
2 changes: 1 addition & 1 deletion include/net/netfilter/nf_tables.h
Original file line number Diff line number Diff line change
@@ -303,7 +303,7 @@ void nft_unregister_set(struct nft_set_ops *ops);
struct nft_set {
struct list_head list;
struct list_head bindings;
char name[IFNAMSIZ];
char name[NFT_SET_MAXNAMELEN];
u32 ktype;
u32 dtype;
u32 size;
1 change: 1 addition & 0 deletions include/uapi/linux/netfilter/nf_tables.h
Original file line number Diff line number Diff line change
@@ -3,6 +3,7 @@

#define NFT_TABLE_MAXNAMELEN 32
#define NFT_CHAIN_MAXNAMELEN 32
#define NFT_SET_MAXNAMELEN 32
#define NFT_USERDATA_MAXLEN 256

/**
6 changes: 3 additions & 3 deletions net/netfilter/nf_tables_api.c
Original file line number Diff line number Diff line change
@@ -2317,7 +2317,7 @@ nft_select_set_ops(const struct nlattr * const nla[],
static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
[NFTA_SET_TABLE] = { .type = NLA_STRING },
[NFTA_SET_NAME] = { .type = NLA_STRING,
.len = IFNAMSIZ - 1 },
.len = NFT_SET_MAXNAMELEN - 1 },
[NFTA_SET_FLAGS] = { .type = NLA_U32 },
[NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
[NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
@@ -2401,7 +2401,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
unsigned long *inuse;
unsigned int n = 0, min = 0;

p = strnchr(name, IFNAMSIZ, '%');
p = strnchr(name, NFT_SET_MAXNAMELEN, '%');
if (p != NULL) {
if (p[1] != 'd' || strchr(p + 2, '%'))
return -EINVAL;
@@ -2696,7 +2696,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
struct nft_table *table;
struct nft_set *set;
struct nft_ctx ctx;
char name[IFNAMSIZ];
char name[NFT_SET_MAXNAMELEN];
unsigned int size;
bool create;
u64 timeout;

0 comments on commit cb39ad8

Please sign in to comment.