ipfilter: Avoid OOB read when ingesting interface names in ip_nat

[cy]

Summary

Rogue callers (i.e. rogue jail) to ip_nat may input interface names
longer than the passed string length. Make sure the interface string
is not longer than specified.

This is not a problem when using the command line interface. Only when
calling ipfilter directly from user code that tries to emulate ipfilter
userland.

Reported by: Ilja Van Sprundel <[e-mail]>
MFC after: 1 day

[emaste]

sys/netpfil/ipfilter/netinet/ip_nat.c

1546

Do we have some existing check that we are guaranteed not to walk off the end of a malicious in_names?

[cy]

I will review my use of strlen throughout. I'll get back to you tomorrow.

sys/netpfil/ipfilter/netinet/ip_nat.c

1546

I suppose I could use an arbitrary number. in_names are interface names.