[PATCH nf 0/4] netfilter: logging cleanups

[Florian Westphal <fw@strlen.de>]

A few patches to address LLM-reported issues.

While working on those LLM also reported that ARPHRD_SIT is dead
code, so:

1) Remove dead ARPHRD_SIT branches from MAC/HW header logging in
nf_log_syslog.c and nfnetlink_log.c. The paths are unreachable ever
since SIT tunnel hard_header_len was set to zero 6 years ago.

Then there are the originally reported issues:

2) Fix MAC header dump in nf_log_syslog to base the byte count on
skb_mac_header_len() clamped to dev->hard_header_len. Prevent logging
IP/IPv6 header bytes as part of the MAC address when the actual MAC header
is shorter than the device's hard header.

3) Extract dev_parse_header usage into a shared helper for nfnetlink_log and
nfnetlink_queue, clamping hw addresses to 8 bytes and validating the skb
mac header. Add BUILD_BUG_ON checks to assert identical container struct
layouts.

4) Use skb_mac_header_len when dumping mac headers in nfnetlink_log and
clamp to hard_header_len.

Skip mac header logging at POST_ROUTING where the header still belongs
to the ingress device.  Originally POST_ROUTING never had incoming
device handed to it, but that changed.   Make it stricter again.

Florian Westphal (4):
  netfilter: nf_log: remove dead ARPHRD_SIT handling from MAC/HW header
    logging
  netfilter: nf_log_syslog: fix MAC header dump to use real header
    length
  netfilter: nfnetlink_log: fix up dev_parse_header usage
  netfilter: nfnetlink_log: rework mac header logging

 net/netfilter/nf_log_syslog.c        | 24 ++-----
 net/netfilter/nfnetlink_log.c        | 90 ++++++++++++++++---------
 net/netfilter/nfnetlink_log_common.h | 99 ++++++++++++++++++++++++++++
 net/netfilter/nfnetlink_queue.c      | 18 ++---
 4 files changed, 167 insertions(+), 64 deletions(-)
 create mode 100644 net/netfilter/nfnetlink_log_common.h
-- 
2.56.0