Kernel clamps udata size at 256 bytes, udata size however also includes internal bookkeeping which brings us over this limit.
Signed-off-by: Florian Westphal <[email protected]> --- Alternative is to just fallback to the comment match, any preference? iptables/nft.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/iptables/nft.c b/iptables/nft.c index c18798c98591..e7cb827bb132 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1041,12 +1041,14 @@ enum udata_type { int add_comment(struct nftnl_rule *r, const char *comment) { struct nftnl_udata_buf *udata; + char comm[254]; udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN); if (!udata) return -ENOMEM; - if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comment)) + snprintf(comm, sizeof(comm), "%s", comment); + if (!nftnl_udata_put_strz(udata, UDATA_TYPE_COMMENT, comm)) return -ENOMEM; nftnl_rule_set_data(r, NFTNL_RULE_USERDATA, nftnl_udata_buf_data(udata), -- 2.14.3 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
