netfilter: nf_tables: Allow object names of up to 255 chars

Same conversion as for table names, use NFT_NAME_MAXLEN as upper
boundary as well.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 66ba62fa7d90e3b8a9d097f85b4a041c8cc76167..f9795fe394f31333c0317aef01bc360763baa8a2 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1016,7 +1016,7 @@ int nft_verdict_dump(struct sk_buff *skb, int type,
  */
 struct nft_object {
        struct list_head                list;
-       char                            name[NFT_OBJ_MAXNAMELEN];
+       char                            *name;
        struct nft_table                *table;
        u32                             genmask:2,
                                        use:30;

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index b5e73e80b7b6aad1a25509a8f2782e1669a7e91c..be25cf69295b4d09d6a3c0a13597e0e88229fc34 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -5,7 +5,7 @@
 #define NFT_TABLE_MAXNAMELEN   NFT_NAME_MAXLEN
 #define NFT_CHAIN_MAXNAMELEN   NFT_NAME_MAXLEN
 #define NFT_SET_MAXNAMELEN     NFT_NAME_MAXLEN
-#define NFT_OBJ_MAXNAMELEN     32
+#define NFT_OBJ_MAXNAMELEN     NFT_NAME_MAXLEN
 #define NFT_USERDATA_MAXLEN    256
 
 /**

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e6a07f27b1a3308ea895838ae2c7ebea63244c9b..149785ff1c7b695e95a30d5149f73edb96a7e796 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4402,15 +4402,21 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
                goto err1;
        }
        obj->table = table;
-       nla_strlcpy(obj->name, nla[NFTA_OBJ_NAME], NFT_OBJ_MAXNAMELEN);
+       obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
+       if (!obj->name) {
+               err = -ENOMEM;
+               goto err2;
+       }
 
        err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
        if (err < 0)
-               goto err2;
+               goto err3;
 
        list_add_tail_rcu(&obj->list, &table->objects);
        table->use++;
        return 0;
+err3:
+       kfree(obj->name);
 err2:
        if (obj->type->destroy)
                obj->type->destroy(obj);
@@ -4626,6 +4632,7 @@ static void nft_obj_destroy(struct nft_object *obj)
                obj->type->destroy(obj);
 
        module_put(obj->type->owner);
+       kfree(obj->name);
        kfree(obj);
 }