summaryrefslogtreecommitdiffstats
path: root/src/ct.c
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2015-06-02 12:53:10 +0200
committerPatrick McHardy <kaber@trash.net>2015-06-02 12:56:53 +0200
commit19719a352683fcf32bfb5e3e61a03fc61c1d94cc (patch)
treec828d7f68ec0b2130dcfda09d483d31adfb18370 /src/ct.c
parent5764e58f0e0b3ace1b1c1cdb5c149a6c679ff6d6 (diff)
ct: add maximum helper length value
The current kernel restricts ct helper names to 16 bytes length. Specify this limit in the ct expression table to catch oversized strings in userspace. Since older versions of nft didn't support larger values, this does not negatively affect interaction with old kernel versions. Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'src/ct.c')
-rw-r--r--src/ct.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/src/ct.c b/src/ct.c
index 2eb85eaf..aa801388 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -161,6 +161,10 @@ static void __init ct_label_table_init(void)
ct_label_tbl = rt_symbol_table_init("/etc/xtables/connlabel.conf");
}
+#ifndef NF_CT_HELPER_NAME_LEN
+#define NF_CT_HELPER_NAME_LEN 16
+#endif
+
static const struct ct_template ct_templates[] = {
[NFT_CT_STATE] = CT_TEMPLATE("state", &ct_state_type,
BYTEORDER_HOST_ENDIAN,
@@ -178,7 +182,8 @@ static const struct ct_template ct_templates[] = {
BYTEORDER_HOST_ENDIAN,
4 * BITS_PER_BYTE),
[NFT_CT_HELPER] = CT_TEMPLATE("helper", &string_type,
- BYTEORDER_HOST_ENDIAN, 0),
+ BYTEORDER_HOST_ENDIAN,
+ NF_CT_HELPER_NAME_LEN * BITS_PER_BYTE),
[NFT_CT_L3PROTOCOL] = CT_TEMPLATE("l3proto", &invalid_type,
BYTEORDER_INVALID,
BITS_PER_BYTE),