From: Florian Westphal <fw@strlen.de>
Date: Thu, 3 May 2018 19:45:59 +0000 (+0200)
Subject: xtables-compat: fall back to comment match in case name is too long
X-Git-Tag: v1.8.0~88
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7af21782bb6fc3480909120c20a55164248a9608;p=thirdparty%2Fiptables.git

xtables-compat: fall back to comment match in case name is too long

... or when using multiple --comment lines.
This is more of a 'cosmetic' fix to handle the test suite case.

Signed-off-by: Florian Westphal <fw@strlen.de>
---

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 26d0d36c..e383cc9f 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -79,8 +79,9 @@ static int nft_ipv4_add(struct nftnl_rule *r, void *data)
 		if (strcmp(matchp->match->name, "comment") == 0) {
 			ret = add_comment(r, (char *)matchp->match->m->data);
 			if (ret < 0)
-				return ret;
+				goto try_match;
 		} else {
+try_match:
 			ret = add_match(r, matchp->match->m);
 			if (ret < 0)
 				return ret;
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index af525422..33f77ebf 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -67,8 +67,9 @@ static int nft_ipv6_add(struct nftnl_rule *r, void *data)
 		if (strcmp(matchp->match->name, "comment") == 0) {
 			ret = add_comment(r, (char *)matchp->match->m->data);
 			if (ret < 0)
-				return ret;
+				goto try_match;
 		} else {
+try_match:
 			ret = add_match(r, matchp->match->m);
 			if (ret < 0)
 				return ret;
diff --git a/iptables/nft.c b/iptables/nft.c
index e7cb827b..76759251 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1041,15 +1041,21 @@ enum udata_type {
 int add_comment(struct nftnl_rule *r, const char *comment)
 {
 	struct nftnl_udata_buf *udata;
-	char comm[254];
+	uint32_t len;
+
+	if (nftnl_rule_get_data(r, NFTNL_RULE_USERDATA, &len))
+		return -EALREADY;
 
 	udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
 	if (!udata)
 		return -ENOMEM;
 
-	snprintf(comm, sizeof(comm), "%s", comment);
-	if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comm))
+	if (strnlen(comment, 255) == 255)
+		return -ENOSPC;
+
+	if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comment))
 		return -ENOMEM;
+
 	nftnl_rule_set_data(r, NFTNL_RULE_USERDATA,
 			    nftnl_udata_buf_data(udata),
 			    nftnl_udata_buf_len(udata));