netfilter: nf_tables: allow set names up to 32 bytes

Currently, we support set names of up to 16 bytes, get this aligned
with the maximum length we can use in ipset to make it easier when
considering migration to nf_tables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index f6b1daf2e69871fa26bd18d56225c0af06017ff1..092235458691fd5eadc09cab3266d100f7140dc6 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -303,7 +303,7 @@ void nft_unregister_set(struct nft_set_ops *ops);
 struct nft_set {
        struct list_head                list;
        struct list_head                bindings;
-       char                            name[IFNAMSIZ];
+       char                            name[NFT_SET_MAXNAMELEN];
        u32                             ktype;
        u32                             dtype;
        u32                             size;

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 660231363bb583f84fb34ebbeb217cbfb81ff433..6a4dbe04f09ed11c4528db16d749c673eac68fad 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -3,6 +3,7 @@
 
 #define NFT_TABLE_MAXNAMELEN   32
 #define NFT_CHAIN_MAXNAMELEN   32
+#define NFT_SET_MAXNAMELEN     32
 #define NFT_USERDATA_MAXLEN    256
 
 /**

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 73c8fad0b8ef66e1758b351c5bb6634119cc3510..4d292b933b5c5c83d205f844f1a876ebefca708c 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2317,7 +2317,7 @@ nft_select_set_ops(const struct nlattr * const nla[],
 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
        [NFTA_SET_TABLE]                = { .type = NLA_STRING },
        [NFTA_SET_NAME]                 = { .type = NLA_STRING,
-                                           .len = IFNAMSIZ - 1 },
+                                           .len = NFT_SET_MAXNAMELEN - 1 },
        [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
        [NFTA_SET_KEY_TYPE]             = { .type = NLA_U32 },
        [NFTA_SET_KEY_LEN]              = { .type = NLA_U32 },
@@ -2401,7 +2401,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
        unsigned long *inuse;
        unsigned int n = 0, min = 0;
 
-       p = strnchr(name, IFNAMSIZ, '%');
+       p = strnchr(name, NFT_SET_MAXNAMELEN, '%');
        if (p != NULL) {
                if (p[1] != 'd' || strchr(p + 2, '%'))
                        return -EINVAL;
@@ -2696,7 +2696,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
        struct nft_table *table;
        struct nft_set *set;
        struct nft_ctx ctx;
-       char name[IFNAMSIZ];
+       char name[NFT_SET_MAXNAMELEN];
        unsigned int size;
        bool create;
        u64 timeout;