Re: [PATCH nf] netfilter: nf_tables: Unbreak audit log reset

[Phil Sutter <phil@nwl.cc>]

Hi Paul,

On Wed, Sep 06, 2023 at 03:56:41PM -0400, Paul Moore wrote:
> On Wed, Sep 6, 2023 at 2:46 PM Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Sep 06, 2023 at 07:08:40PM +0200, Phil Sutter wrote:
> > [...]
> > > The last six come from the 'reset rules table t1' command. While on one
> > > hand it looks like nftables fits only three rules into a single skb,
> > > your fix seems to have a problem in that it doesn't subtract s_idx from
> > > *idx.
> >
> > Please, feel free to follow up to refine, thanks.
> 
> Forgive me if I'm wrong, but it sounds as though Phil was pointing out
> a bug and not an area of refinement, is that correct Phil?

From my point of view, yes. Though the third parameter "nentries" to
audit_log_nfcfg() is sometimes used in rather creative ways,
nf_tables_dump_obj() for instance passes the handle of the object being
reset instead of a count. So I assume whoever parses audit logs won't
rely too much upon the 'entries=NNN' part, anyway.

> If it is a bug, please submit a fix for this as soon as possible Pablo.

Thanks for your support, but I can take over, too. The number of
notifications emitted even for a small ruleset is not ideal, also. It's
just a bit sad that I ACKed the patch already and so it went out the
door. Florian, can we still put a veto there?

Cheers, Phil