Re: [PATCH] Don't call nf_log_packet in NFLOG module.

[Patrick McHardy <kaber@trash.net>]

Eric Leblond wrote:
> This patch modifies xt_NFLOG to suppress the call to nf_log_packet()
> function. The call of this wrapper in xt_NFLOG was causing NFLOG to
> use the first initialized module. Thus, if ipt_ULOG is loaded before
> nfnetlink_log all NFLOG rules are treated as plain LOG rules.

Oops, this slipped through somehow. It has been an intentional
decision to use the registered logging backends though, just changing
it to unconditionally use nfnetlink_log only solves the problem
partially.

The main problem is that the policy which backend to use is defined
by module load order, which is obviously a pretty bad idea. This does
not only affect xt_NFLOG, but also internal conntrack logging and
anything else we might want to use this for in the future.

So I think what we should do instead is introduce a proper way to
select among the logging backends. We could introduce a global
policy, or split by subsystem, which would currently be just
"conntrack" and "NFLOG".

And perhaps we should start getting rid of ULOG completely to
simplify this stuff.

But I'm open to being convinced of better ways :)