Re: possible issues with blowing up struct ipt_log_info

[Roberto Nibali <ratz@drugphish.ch>]

> I remember saying here that it would be cool to have the log prefix length
> tunable at kernel LOG module insertion, have it exported (read-only) to some
> /proc entry, and have userspace (iptables, or any other upper-level
> application) rely on the real-time extracted value.
> What do you think?

Could work, although I'm not sure why you'd want to change the prefix 
lenght that often, however flexibility is nice.

Another issue I see is that iptables, when sending the data from user to 
kernel space, must be made aware of setting the correct target{info}size 
in case the ipt_*LOG module is not loaded yet. Parsing proc-fs would be 
useless. This opens a possible "DoS", which can be addressed by having a 
max log prefix length accepted as being passed to the lkm.

Was there any consensus regarding this feature among the core netfilter 
developers or has anyone posted a POC patch? Granted, there are a 
billion more important things to address, but still ... ;)

Regards,
Roberto Nibali, ratz
-- 
echo 
'[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc