| Message ID | 20171219110443.3286-1-pablo@netfilter.org |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [nf] netfilter: nf_tables: fix chain filter in nf_tables_dump_rules() | expand |
On Tue, Dec 19, 2017 at 12:04:43PM +0100, Pablo Neira Ayuso wrote: > ctx->chain may be null now that we have very large object names, > so we cannot check for ctx->chain[0] here. > > Fixes: e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 chars") This really fixes: b7263e071aba7 ("netfilter: nf_tables: Allow chain name of up to 255 chars") > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Apart from that: Acked-by: Phil Sutter <phil@nwl.cc> Thanks, Phil -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Tue, Dec 19, 2017 at 12:21:51PM +0100, Phil Sutter wrote: > On Tue, Dec 19, 2017 at 12:04:43PM +0100, Pablo Neira Ayuso wrote: > > ctx->chain may be null now that we have very large object names, > > so we cannot check for ctx->chain[0] here. > > > > Fixes: e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 chars") > > This really fixes: > > b7263e071aba7 ("netfilter: nf_tables: Allow chain name of up to 255 chars") Will fix it here. > > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > > Apart from that: > > Acked-by: Phil Sutter <phil@nwl.cc> Thanks for reviewing! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 10798b357481..8d4526651661 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2072,7 +2072,7 @@ static int nf_tables_dump_rules(struct sk_buff *skb, continue; list_for_each_entry_rcu(chain, &table->chains, list) { - if (ctx && ctx->chain[0] && + if (ctx && ctx->chain && strcmp(ctx->chain, chain->name) != 0) continue;
ctx->chain may be null now that we have very large object names, so we cannot check for ctx->chain[0] here. Fixes: e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 chars") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)