From: Florian Westphal <fw@strlen.de>
To: Phil Sutter <phil@nwl.cc>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>,
netfilter-devel@vger.kernel.org, Florian Westphal <fw@strlen.de>,
audit@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com
Subject: Re: [nf PATCH v3 1/2] netfilter: nf_tables: Fix entries val in rule reset audit log
Date: Wed, 13 Sep 2023 21:31:46 +0200 [thread overview]
Message-ID: <20230913193146.GA25164@breakpoint.cc> (raw)
In-Reply-To: <20230913135137.15154-2-phil@nwl.cc>
Phil Sutter <phil@nwl.cc> wrote:
> The value in idx and the number of rules handled in that particular
> __nf_tables_dump_rules() call is not identical. The former is a cursor
> to pick up from if multiple netlink messages are needed, so its value is
> ever increasing. Fixing this is not just a matter of subtracting s_idx
> from it, though: When resetting rules in multiple chains,
> __nf_tables_dump_rules() is called for each and cb->args[0] is not
> adjusted in between. Introduce a dedicated counter to record the number
> of rules reset in this call in a less confusing way.
>
> While being at it, prevent the direct return upon buffer exhaustion: Any
> rules previously dumped into that skb would evade audit logging
> otherwise.
Reviewed-by: Florian Westphal <fw@strlen.de>
We can investigate ways to compress/coalesce (read: make this more
complicated) in case somebody complains about too many audit messages.
But I would not go ahead and keep it simple for now.
next prev parent reply other threads:[~2023-09-13 19:31 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-13 13:51 [nf PATCH v3 0/2] nf_tables: follow-up on audit fix, add selftest Phil Sutter
2023-09-13 13:51 ` [nf PATCH v3 1/2] netfilter: nf_tables: Fix entries val in rule reset audit log Phil Sutter
2023-09-13 19:31 ` Florian Westphal [this message]
2023-09-13 20:38 ` Phil Sutter
2023-09-13 13:51 ` [nf PATCH v3 2/2] selftests: netfilter: Test nf_tables audit logging Phil Sutter
2023-09-13 20:03 ` [nf PATCH v3 0/2] nf_tables: follow-up on audit fix, add selftest Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230913193146.GA25164@breakpoint.cc \
--to=fw@strlen.de \
--cc=audit@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=paul@paul-moore.com \
--cc=phil@nwl.cc \
--cc=rgb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.