<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - netfilter/nftables secmark support limited to 255 bytes"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1749">1749</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>netfilter/nftables secmark support limited to 255 bytes
</td>
</tr>
<tr>
<th>Product</th>
<td>netfilter/iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>unknown
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>joe@nall.com
</td>
</tr></table>
<p>
<div>
<pre>The kernel and nftables userspace are both limited to 255 byte
(NFT_SECMARK_CTX_MAXLEN) SELinux secmark contexts.
If we start with 44 characters of non category SELinux packet context
system_u:object_r:http_client_packet_t:s10:
we are left with 211 bytes for category bit representation.
If we are using 1024 category bits, it could take 5 bytes for each bit if they
are spread out
c100,c123,c201,...
This only gives us 42 usable category bits worst case.
We have real world SELinux contexts that don't fit in 255 bytes. We sorted this
out in Labeled IPSec and netlabel years ago but had not tried to used secmark
until recently.
Is it possible to increase this limit to 4k or remove the explicit limit
entirely?</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>