From: Phil Sutter <phil@nwl.cc>
Date: Thu, 1 Dec 2022 12:09:48 +0000 (+0100)
Subject: nft: Fix for comparing ifname matches against nft-generated ones
X-Git-Tag: v1.8.9~26
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f200aca7ff7b6a0edbe9024f0543b3f58111c50e;p=thirdparty%2Fiptables.git

nft: Fix for comparing ifname matches against nft-generated ones

Since nft adds the interface name as fixed-size string of 16 bytes,
filling a mask based on the length value will not match the mask nft
set.

Fixes: 652b98e793711 ("xtables-compat: fix wildcard detection")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index f1503b6c..03e13fdc 100644
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -279,7 +279,7 @@ static void parse_ifname(const char *name, unsigned int len, char *dst, unsigned
 	memcpy(dst, name, len);
 	if (name[len - 1] == '\0') {
 		if (mask)
-			memset(mask, 0xff, len);
+			memset(mask, 0xff, strlen(name) + 1);
 		return;
 	}