Home » Mailing list archives » linux-netdev » 2009 » March » 25

Re: [patch 3/6] netfilter: limit the length of the helper name

Previous thread: [patch 5/6] netfilter: add generic function to get len of generic policy by Holger Eitzenberger on Monday, March 16, 2009 - 3:07 pm. (1 message)

Next thread: [patch 4/6] ctnetlink: allocate right-sized ctnetlink skb by Holger Eitzenberger on Monday, March 16, 2009 - 3:07 pm. (2 messages)
[view original message]
From: Holger Eitzenberger
Subject: [patch 3/6] netfilter: limit the length of the helper name
Date: Monday, March 16, 2009 - 3:07 pm

This is necessary in order to have an upper bound for Netlink
message calculation, which is not a problem at all, as there
are no helpers with a longer name.

Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>

Index: net-next-2.6/include/net/netfilter/nf_conntrack_helper.h
===================================================================
--- net-next-2.6.orig/include/net/netfilter/nf_conntrack_helper.h
+++ net-next-2.6/include/net/netfilter/nf_conntrack_helper.h
@@ -14,6 +14,8 @@
 
 struct module;
 
+#define NF_CT_HELPER_NAME_LEN	16
+
 struct nf_conntrack_helper
 {
 	struct hlist_node hnode;	/* Internal use. */
Index: net-next-2.6/net/netfilter/nf_conntrack_helper.c
===================================================================
--- net-next-2.6.orig/net/netfilter/nf_conntrack_helper.c
+++ net-next-2.6/net/netfilter/nf_conntrack_helper.c
@@ -142,6 +142,7 @@ int nf_conntrack_helper_register(struct 
 
 	BUG_ON(me->expect_policy == NULL);
 	BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES);
+	BUG_ON(strlen(me->name) >= NF_CT_HELPER_NAME_LEN - 1);
 
 	mutex_lock(&nf_ct_helper_mutex);
 	hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]);

-- 
--


[ message continues ]
[view original message]
From: Patrick McHardy
Subject: Re: [patch 3/6] netfilter: limit the length of the helper name
Date: Wednesday, March 25, 2009 - 10:32 am

This appears to be an off-by-one. A strlen of exactly
NF_CT_HELPER_NAME_LEN - 1 would be fine, right?

No need to resend, just let me know whether I should change it.
--


[ message continues ]
[view original message]
From: Holger Eitzenberger
Subject: Re: [patch 3/6] netfilter: limit the length of the helper name
Date: Wednesday, March 25, 2009 - 10:41 am

Yes please, feel free to change it :).

 /holger


--


[ message continues ]
[view original message]
From: Patrick McHardy
Subject: Re: [patch 3/6] netfilter: limit the length of the helper name
Date: Wednesday, March 25, 2009 - 10:44 am

Done and applied, thanks.
--


[ message continues ]
Previous thread: [patch 5/6] netfilter: add generic function to get len of generic policy by Holger Eitzenberger on Monday, March 16, 2009 - 3:07 pm. (1 message)

Next thread: [patch 4/6] ctnetlink: allocate right-sized ctnetlink skb by Holger Eitzenberger on Monday, March 16, 2009 - 3:07 pm. (2 messages)