src: check if the set name is too long

checks if the name of set is larger than 15 chars before to add it.
If so, the set is not added and an error message is printed.

I didn't figure out why, but another error message is printed, see below:

nft add set ip test thenameofthissetistoolooong { type ipv4_address\; } <cmdline>:1:17-43: Error: set name is too long (> 16)
add set ip test thenameofthissetistoolooong { type ipv4_address; }

                ^^^^^^^^^^^^^^^^^^^^^^^^^^^

<cmdline>:1:66-66: Error: syntax error, unexpected '}' add set ip test thenameofthissetistoolooong { type ipv4_address; }

---
 src/parser.y | 12 ++++++++++++
 1 file changed, 12 insertions(+)

index db6f493..17fbd5e 100644
@@ -15,6 +15,7 @@
 #include <inttypes.h>
 #include <netinet/ip.h>
 #include <netinet/if_ether.h>
+#include <net/if.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 #include <linux/netfilter/nf_conntrack_tuple_common.h>

@@ -986,6 +987,11 @@ chain_identifier	:	identifier
 
 set_spec		:	table_spec	identifier
 			{
+				if (strlen($2) > IFNAMSIZ) {
+					erec_queue(error(&@2, "set name too long (> %d)", IFNAMSIZ),
+						   state->msgs);
+					YYERROR;
+				}
 				$$		= $1;
 				$$.set		= $2;
 			}

@@ -993,6 +999,12 @@ set_spec		:	table_spec	identifier
 
 set_identifier		:	identifier
 			{
+				if (strlen($1) > IFNAMSIZ) {
+					erec_queue(error(&@1, "set name too long (> %d", IFNAMSIZ),
+						   state->msgs);
+					YYERROR;
+				}
+
 				memset(&$$, 0, sizeof($$));
 				$$.set		= $1;
 			}

1.8.3.2

Hi Giuseppe,

You mean 16 characters

Btw, have you tested 16 chars length name: when listing the set back, is such name cut to 15 chars?

That sounds to be an issue from kernel side, at least looking quickly, I could not find any code shortening this in libmnl, libnftnl or nftables.

Tomasz

The kernel is indeed limiting the name length in nf_tables_newset, see nla_strcpy there.

Hi Wei,

I don't know how you ended up finding a relation between nftables API and genetlink, but it's bogus.

The set name has a fixed size of 16 characters (IFNAMSIZ), not 15. And its netlink policy has nothing to do with genetlink.

Have a look at include/net/netfilter/nf_tables.h in kernel tree, there struct nft_set is declared. Its netlink related policy is in net/netfilter/nf_tables_api.c (nft_set_policy)

Br,

Tomasz