Migration: openvpn device name lenght

[francio87]

While migrating OpenVPN tunnels, it has been observed that if the device name exceeds 16 characters, an error occurs in NFT. This issue prevents the proper startup of the service

Steps to reproduce

• Migrate a firewall where the VPN tunnel name was tunnel-uffici

Expected behavior

The VPN tunnel should be active and functioning correctly after migration.

Actual behavior

The VPN tunnel is imported with its name properly truncated in the ns_name property, but the dev property of OpenVPN contains a device name that exceeds the maximum length of 16 characters.

root@ns-fwsede:~# uci show openvpn.ns_tunnel_.ns_name
openvpn.ns_tunnel_.ns_name='tunnel-uff'

root@ns-fwsede:~# uci show openvpn.ns_tunnel_.dev
openvpn.ns_tunnel_.dev='tuntunnel-uffici'

This leads to an error when nft attempts to apply the firewall rules:

/dev/stdin:83:11-28: Error: String exceeds maximum length of 16
                iifname "tuntunnel-uffici" jump input_openvpn comment "!fw4: Handle openvpn IPv4/IPv6 input traffic"
                        ^^^^^^^^^^^^^^^^^^

Components

NethSecurity version: 8-23.05.5-ns.1.4.1

[github-actions]

Testing image version: 8-23.05.5-ns.1.4.1-51-gcbbc735

[gsanchietti]

Test case
Check the issue is not reproducibile

[francio87]

Confirm Fixed, tested with release 23.05.5-ns.1.4.1-53-g3049dab

Nsec 7.9:

Nsec 8:

root@ns79:~# uci show openvpn.ns_tunnel_.ns_name
openvpn.ns_tunnel_.ns_name='tunnel-sed'

root@ns79:~# uci show openvpn.ns_tunnel_.dev
openvpn.ns_tunnel_.dev='tuntunnel-seder'

root@ns79:~# ip a sh tuntunnel-seder
11: tuntunnel-seder: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 10.19.189.1/24 scope global tuntunnel-seder
       valid_lft forever preferred_lft forever
    inet6 fe80::c377:bb1d:490b:392b/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

fw4 reload without issue :

root@ns79:~# fw4 reload
Section ns_user_include specifies unreachable path '/etc/firewall.user', ignoring section
Automatically including '/usr/share/nftables.d/chain-pre/input/20-don.nft'
Automatically including '/usr/share/nftables.d/chain-pre/srcnat/20netmap.nft'
Automatically including '/usr/share/nftables.d/chain-post/dstnat/20netmap.nft'