Kernel clamps udata size at 256 bytes, udata size however also includes
internal bookkeeping which brings us over this limit.
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
Alternative is to just fallback to the comment match,
any preference?
iptables/nft.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/iptables/nft.c b/iptables/nft.c
index c18798c98591..e7cb827bb132 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1041,12 +1041,14 @@ enum udata_type {
int add_comment(struct nftnl_rule *r, const char *comment)
{
struct nftnl_udata_buf *udata;
+ char comm[254];
udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
if (!udata)
return -ENOMEM;
- if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comment))
+ snprintf(comm, sizeof(comm), "%s", comment);
+ if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comm))
return -ENOMEM;
nftnl_rule_set_data(r, NFTNL_RULE_USERDATA,
nftnl_udata_buf_data(udata),
--
2.14.3
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
