diff options
| author | Thomas Haller <thaller@redhat.com> | 2023-10-23 19:00:47 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-11-21 15:45:45 +0100 |
| commit | f0653192f47f8989ccd0d5ca62432ea255093b60 (patch) | |
| tree | 4f3584ff5cf3edc36eeb03e870bc7a309f88d6f4 | |
| parent | e1c813c4137e15e8f28a937e8f9a00d1a6784838 (diff) | |
parser_bison: fix length check for ifname in ifname_expr_alloc()
commit 122dce6b35205a3df419a5cae9acfd6e83e8725a upstream.
IFNAMSIZ is 16, and the allowed byte length of the name is one less than
that. Fix the length check and adjust a test for covering the longest
allowed interface name.
This is obviously a change in behavior, because previously interface
names with length 16 were accepted and were silently truncated along the
way. Now they are rejected as invalid.
Fixes: fa52bc225806 ("parser: reject zero-length interface names")
Signed-off-by: Thomas Haller <thaller@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | src/parser_bison.y | 3 | ||||
| -rwxr-xr-x | tests/shell/testcases/chains/0042chain_variable_0 | 19 |
2 files changed, 21 insertions, 1 deletions
diff --git a/src/parser_bison.y b/src/parser_bison.y index f1d85db3..c1e8cfe6 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -15,6 +15,7 @@ #include <stdio.h> #include <inttypes.h> #include <syslog.h> +#include <net/if.h> #include <netinet/ip.h> #include <netinet/tcp.h> #include <netinet/if_ether.h> @@ -157,7 +158,7 @@ static struct expr *ifname_expr_alloc(const struct location *location, return NULL; } - if (length > 16) { + if (length >= IFNAMSIZ) { xfree(name); erec_queue(error(location, "interface name too long"), queue); return NULL; diff --git a/tests/shell/testcases/chains/0042chain_variable_0 b/tests/shell/testcases/chains/0042chain_variable_0 index 58535f76..5628e19c 100755 --- a/tests/shell/testcases/chains/0042chain_variable_0 +++ b/tests/shell/testcases/chains/0042chain_variable_0 @@ -18,6 +18,25 @@ EXPECTED="define if_main = \"lo\" table netdev filter2 { chain Main_Ingress2 { + type filter hook ingress devices = { \$if_main, d23456789012345x } priority -500; policy accept; + } +}" + +rc=0 +$NFT -f - <<< $EXPECTED || rc=$? +test "$rc" = 1 +cat <<EOF | $DIFF -u <($NFT list ruleset) - +table netdev filter1 { + chain Main_Ingress1 { + type filter hook ingress device "lo" priority -500; policy accept; + } +} +EOF + +EXPECTED="define if_main = \"lo\" + +table netdev filter2 { + chain Main_Ingress2 { type filter hook ingress devices = { \$if_main, dummy0 } priority -500; policy accept; } }" |