Re: [PATCH nf] netfilter: nf_tables: report error if stateful obj's name is truncated

[Florian Westphal <fw@strlen.de>]

Liping Zhang <zlpnobody@gmail.com> wrote:
> > At quick glance, I can see other spots lacking this validation:
> >
> > static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] =
> > {
> >         [NFTA_CHAIN_TABLE]      = { .type = NLA_STRING },
> >
> > Probably review and fix them in one go?
> 
> The nft table name's size is limited at this place:
> static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
>         [NFTA_TABLE_NAME] = { .type = NLA_STRING,
>                                                    .len =
> NFT_TABLE_MAXNAMELEN - 1 },
> 
> If NFTA_CHAIN_TABLE's size exceeded 31, nf_tables_table_lookup will
> fail eventually.
> 
> So I think adding the validation of NFTA_CHAIN_TABLE's size is not
> important.

Perhaps but its better to have it anyway so that you don't need this
extra context to understand that its limited in practice.