From 7af21782bb6fc3480909120c20a55164248a9608 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Thu, 3 May 2018 21:45:59 +0200 Subject: xtables-compat: fall back to comment match in case name is too long ... or when using multiple --comment lines. This is more of a 'cosmetic' fix to handle the test suite case. Signed-off-by: Florian Westphal --- iptables/nft.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'iptables/nft.c') diff --git a/iptables/nft.c b/iptables/nft.c index e7cb827b..76759251 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1041,15 +1041,21 @@ enum udata_type { int add_comment(struct nftnl_rule *r, const char *comment) { struct nftnl_udata_buf *udata; - char comm[254]; + uint32_t len; + + if (nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len)) + return -EALREADY; udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN); if (!udata) return -ENOMEM; - snprintf(comm, sizeof(comm), "%s", comment); - if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comm)) + if (strnlen(comment, 255) == 255) + return -ENOSPC; + + if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comment)) return -ENOMEM; + nftnl_rule_set_data(r, NFTNL_RULE_USERDATA, nftnl_udata_buf_data(udata), nftnl_udata_buf_len(udata)); -- cgit v1.2.3