From f0653192f47f8989ccd0d5ca62432ea255093b60 Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Mon, 23 Oct 2023 19:00:47 +0200
Subject: [PATCH] parser_bison: fix length check for ifname in
 ifname_expr_alloc()

commit 122dce6b35205a3df419a5cae9acfd6e83e8725a upstream.

IFNAMSIZ is 16, and the allowed byte length of the name is one less than
that. Fix the length check and adjust a test for covering the longest
allowed interface name.

This is obviously a change in behavior, because previously interface
names with length 16 were accepted and were silently truncated along the
way. Now they are rejected as invalid.

Fixes: fa52bc225806 ("parser: reject zero-length interface names")
Signed-off-by: Thomas Haller <thaller@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/parser_bison.y                            |  3 ++-
 .../testcases/chains/0042chain_variable_0     | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/parser_bison.y b/src/parser_bison.y
index f1d85db33..c1e8cfe6d 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -15,6 +15,7 @@
 #include <stdio.h>
 #include <inttypes.h>
 #include <syslog.h>
+#include <net/if.h>
 #include <netinet/ip.h>
 #include <netinet/tcp.h>
 #include <netinet/if_ether.h>
@@ -157,7 +158,7 @@ static struct expr *ifname_expr_alloc(const struct location *location,
 		return NULL;
 	}
 
-	if (length > 16) {
+	if (length >= IFNAMSIZ) {
 		xfree(name);
 		erec_queue(error(location, "interface name too long"), queue);
 		return NULL;
diff --git a/tests/shell/testcases/chains/0042chain_variable_0 b/tests/shell/testcases/chains/0042chain_variable_0
index 58535f76c..5628e19cb 100755
--- a/tests/shell/testcases/chains/0042chain_variable_0
+++ b/tests/shell/testcases/chains/0042chain_variable_0
@@ -16,6 +16,25 @@ $NFT -f - <<< $EXPECTED
 
 EXPECTED="define if_main = \"lo\"
 
+table netdev filter2 {
+	chain Main_Ingress2 {
+		type filter hook ingress devices = { \$if_main, d23456789012345x } priority -500; policy accept;
+	}
+}"
+
+rc=0
+$NFT -f - <<< $EXPECTED || rc=$?
+test "$rc" = 1
+cat <<EOF | $DIFF -u <($NFT list ruleset) -
+table netdev filter1 {
+	chain Main_Ingress1 {
+		type filter hook ingress device "lo" priority -500; policy accept;
+	}
+}
+EOF
+
+EXPECTED="define if_main = \"lo\"
+
 table netdev filter2 {
 	chain Main_Ingress2 {
 		type filter hook ingress devices = { \$if_main, dummy0 } priority -500; policy accept;
-- 
2.47.3