From: Florian Westphal <fw@strlen.de>
To: Phil Sutter <phil@nwl.cc>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>,
netfilter-devel@vger.kernel.org, Florian Westphal <fw@strlen.de>,
audit@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com
Subject: Re: [nf PATCH v3 1/2] netfilter: nf_tables: Fix entries val in rule reset audit log
Date: Wed, 13 Sep 2023 21:31:46 +0200 [thread overview]
Message-ID: <20230913193146.GA25164@breakpoint.cc> (raw)
In-Reply-To: <20230913135137.15154-2-phil@nwl.cc>
Phil Sutter <phil@nwl.cc> wrote:
> The value in idx and the number of rules handled in that particular
> __nf_tables_dump_rules() call is not identical. The former is a cursor
> to pick up from if multiple netlink messages are needed, so its value is
> ever increasing. Fixing this is not just a matter of subtracting s_idx
> from it, though: When resetting rules in multiple chains,
> __nf_tables_dump_rules() is called for each and cb->args[0] is not
> adjusted in between. Introduce a dedicated counter to record the number
> of rules reset in this call in a less confusing way.
>
> While being at it, prevent the direct return upon buffer exhaustion: Any
> rules previously dumped into that skb would evade audit logging
> otherwise.
Reviewed-by: Florian Westphal <fw@strlen.de>
We can investigate ways to compress/coalesce (read: make this more
complicated) in case somebody complains about too many audit messages.
But I would not go ahead and keep it simple for now.
next prev parent reply other threads:[~2023-09-13 19:31 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-13 13:51 [nf PATCH v3 0/2] nf_tables: follow-up on audit fix, add selftest Phil Sutter
2023-09-13 13:51 ` [nf PATCH v3 1/2] netfilter: nf_tables: Fix entries val in rule reset audit log Phil Sutter
2023-09-13 19:31 ` Florian Westphal [this message]
2023-09-13 20:38 ` Phil Sutter
2023-09-13 13:51 ` [nf PATCH v3 2/2] selftests: netfilter: Test nf_tables audit logging Phil Sutter
2023-09-13 20:03 ` [nf PATCH v3 0/2] nf_tables: follow-up on audit fix, add selftest Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230913193146.GA25164@breakpoint.cc \
--to=fw@strlen.de \
--cc=audit@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=paul@paul-moore.com \
--cc=phil@nwl.cc \
--cc=rgb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox