mnl: do not use expr->identifier to fetch device name

This string might not be nul-terminated, resulting in spurious errors
when adding netdev chains.

Fixes: 3fdc7541fba0 ("src: add multidevice support for netdev chain")
Fixes: 92911b362e90 ("src: add support to add flowtables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/mnl.c b/src/mnl.c
index 4f42795e0f12dbdaabcbff10c14aa276cf081e04..bca5add0f8ebc9c2afc30166ca8e3c346c267bc6 100644 (file)
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -26,6 +26,7 @@
 
 #include <mnl.h>
 #include <string.h>
+#include <net/if.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>
 #include <fcntl.h>
@@ -609,7 +610,9 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, struct cmd *cmd,
 {
        int priority, policy, i = 0;
        struct nftnl_chain *nlc;
+       unsigned int ifname_len;
        const char **dev_array;
+       char ifname[IFNAMSIZ];
        struct nlmsghdr *nlh;
        struct expr *expr;
        int dev_array_len;
@@ -635,7 +638,12 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, struct cmd *cmd,
                        dev_array = xmalloc(sizeof(char *) * 8);
                        dev_array_len = 8;
                        list_for_each_entry(expr, &cmd->chain->dev_expr->expressions, list) {
-                               dev_array[i++] = expr->identifier;
+                               ifname_len = div_round_up(expr->len, BITS_PER_BYTE);
+                               memset(ifname, 0, sizeof(ifname));
+                               mpz_export_data(ifname, expr->value,
+                                               BYTEORDER_HOST_ENDIAN,
+                                               ifname_len);
+                               dev_array[i++] = xstrdup(ifname);
                                if (i == dev_array_len) {
                                        dev_array_len *= 2;
                                        dev_array = xrealloc(dev_array,
@@ -650,6 +658,10 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, struct cmd *cmd,
                                nftnl_chain_set_data(nlc, NFTNL_CHAIN_DEVICES, dev_array,
                                                     sizeof(char *) * dev_array_len);
 
+                       i = 0;
+                       while (dev_array[i] != NULL)
+                               xfree(dev_array[i++]);
+
                        xfree(dev_array);
                }
        }
@@ -1565,7 +1577,9 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, struct cmd *cmd,
                          unsigned int flags)
 {
        struct nftnl_flowtable *flo;
+       unsigned int ifname_len;
        const char **dev_array;
+       char ifname[IFNAMSIZ];
        struct nlmsghdr *nlh;
        int i = 0, len = 1;
        struct expr *expr;
@@ -1586,13 +1600,24 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, struct cmd *cmd,
        list_for_each_entry(expr, &cmd->flowtable->dev_expr->expressions, list)
                len++;
 
-       dev_array = calloc(len, sizeof(char *));
-       list_for_each_entry(expr, &cmd->flowtable->dev_expr->expressions, list)
-               dev_array[i++] = expr->identifier;
+       dev_array = xmalloc(sizeof(char *) * len);
+
+       list_for_each_entry(expr, &cmd->flowtable->dev_expr->expressions, list) {
+               ifname_len = div_round_up(expr->len, BITS_PER_BYTE);
+               memset(ifname, 0, sizeof(ifname));
+               mpz_export_data(ifname, expr->value, BYTEORDER_HOST_ENDIAN,
+                               ifname_len);
+               dev_array[i++] = xstrdup(ifname);
+       }
 
        dev_array[i] = NULL;
        nftnl_flowtable_set_data(flo, NFTNL_FLOWTABLE_DEVICES,
                                 dev_array, sizeof(char *) * len);
+
+       i = 0;
+       while (dev_array[i] != NULL)
+               xfree(dev_array[i++]);
+
        free(dev_array);
 
        netlink_dump_flowtable(flo, ctx);

diff --git a/src/parser_bison.y b/src/parser_bison.y
index ad512cdbb4c255d2189979f6e8a313dd62ae6d01..fd00b40a104af0a11af4698cd6aae43722dc095c 100644 (file)
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -1909,9 +1909,9 @@ flowtable_list_expr       :       flowtable_expr_member
 
 flowtable_expr_member  :       STRING
                        {
-                               $$ = symbol_expr_alloc(&@$, SYMBOL_VALUE,
-                                                      current_scope(state),
-                                                      $1);
+                               $$ = constant_expr_alloc(&@$, &string_type,
+                                                        BYTEORDER_HOST_ENDIAN,
+                                                        strlen($1) * BITS_PER_BYTE, $1);
                                xfree($1);
                        }
                        ;