diff options
| author | Florian Westphal <fw@strlen.de> | 2018-05-03 21:45:59 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2018-05-04 23:24:50 +0200 |
| commit | 7af21782bb6fc3480909120c20a55164248a9608 (patch) | |
| tree | 55d1f02d74df8f39125b449b3574c4745889ac65 /iptables | |
| parent | e9aeecf5956462f3a1b6cb21ea70280845948325 (diff) | |
xtables-compat: fall back to comment match in case name is too long
... or when using multiple --comment lines.
This is more of a 'cosmetic' fix to handle the test suite case.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'iptables')
| -rw-r--r-- | iptables/nft-ipv4.c | 3 | ||||
| -rw-r--r-- | iptables/nft-ipv6.c | 3 | ||||
| -rw-r--r-- | iptables/nft.c | 12 |
3 files changed, 13 insertions, 5 deletions
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 26d0d36c..e383cc9f 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -79,8 +79,9 @@ static int nft_ipv4_add(struct nftnl_rule *r, void *data) if (strcmp(matchp->match->name, "comment") == 0) { ret = add_comment(r, (char *)matchp->match->m->data); if (ret < 0) - return ret; + goto try_match; } else { +try_match: ret = add_match(r, matchp->match->m); if (ret < 0) return ret; diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index af525422..33f77ebf 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -67,8 +67,9 @@ static int nft_ipv6_add(struct nftnl_rule *r, void *data) if (strcmp(matchp->match->name, "comment") == 0) { ret = add_comment(r, (char *)matchp->match->m->data); if (ret < 0) - return ret; + goto try_match; } else { +try_match: ret = add_match(r, matchp->match->m); if (ret < 0) return ret; diff --git a/iptables/nft.c b/iptables/nft.c index e7cb827b..76759251 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1041,15 +1041,21 @@ enum udata_type { int add_comment(struct nftnl_rule *r, const char *comment) { struct nftnl_udata_buf *udata; - char comm[254]; + uint32_t len; + + if (nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len)) + return -EALREADY; udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN); if (!udata) return -ENOMEM; - snprintf(comm, sizeof(comm), "%s", comment); - if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comm)) + if (strnlen(comment, 255) == 255) + return -ENOSPC; + + if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comment)) return -ENOMEM; + nftnl_rule_set_data(r, NFTNL_RULE_USERDATA, nftnl_udata_buf_data(udata), nftnl_udata_buf_len(udata)); |