Skip to content
  • Liping Zhang's avatar
    netfilter: nft_log: restrict the log prefix length to 127 · 5ce6b04c
    Liping Zhang authored
    First, log prefix will be truncated to NF_LOG_PREFIXLEN-1, i.e. 127,
    at nf_log_packet(), so the extra part is useless.
    
    Second, after adding a log rule with a very very long prefix, we will
    fail to dump the nft rules after this _special_ one, but acctually,
    they do exist. For example:
      # name_65000=$(printf "%0.sQ" {1..65000})
      # nft add rule filter output log prefix "$name_65000"
      # nft add rule filter output counter
      # nft add rule filter output counter
      # nft list chain filter output
      table ip filter {
          chain output {
              type filter hook output priority 0; policy accept;
          }
      }
    
    So now, restrict the log prefix length to NF_LOG_PREFIXLEN-1.
    
    Fixes: 96518518
    
     ("netfilter: add nftables")
    Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    5ce6b04c