Florian Westphal b55e492f06 netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
[ Upstream commit b462579b2b86a8f5230543cadd3a4836be27baf7 ]

nftables has two types of sets/maps, one where userspace defines the
name, and anonymous sets/maps, where userspace defines a template name.

For the latter, kernel requires presence of exactly one "%d".
nftables uses "__set%d" and "__map%d" for this.  The kernel will
expand the format specifier and replaces it with the smallest unused
number.

As-is, userspace could define a template name that allows to move
the set name past the 256 bytes upperlimit (post-expansion).

I don't see how this could be a problem, but I would prefer if userspace
cannot do this, so add a limit of 16 bytes for the '%d' template name.

16 bytes is the old total upper limit for set names that existed when
nf_tables was merged initially.

Fixes: 387454901bd6 ("netfilter: nf_tables: Allow set names of up to 255 chars")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-02-23 08:24:51 +01:00
..
2022-04-20 09:19:40 +02:00
2024-01-15 18:25:25 +01:00
2023-10-25 11:53:19 +02:00
2023-06-21 15:44:10 +02:00
2023-01-18 11:41:09 +01:00
2024-02-23 08:24:50 +01:00
2023-09-23 10:59:43 +02:00
2023-05-17 11:35:59 +02:00
2023-07-27 08:37:23 +02:00
2023-10-25 11:53:21 +02:00
2021-06-18 09:59:00 +02:00
2023-06-21 15:44:10 +02:00
2023-06-21 15:44:10 +02:00