[PATCH net-2.6/stable] [XFRM] AUDIT: Fix flowlabel text format.

[PATCH net-2.6/stable] [XFRM] AUDIT: Fix flowlabel text format.

[YOSHIFUJI Hideaki / 吉藤英明]

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

---
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5dcc10b..fac27ce 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2112,7 +2112,7 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
 		iph6 = ipv6_hdr(skb);
 		audit_log_format(audit_buf,
 				 " src=" NIP6_FMT " dst=" NIP6_FMT
-				 " flowlbl=0x%x%x%x",
+				 " flowlbl=0x%x%02x%02x",
 				 NIP6(iph6->saddr),
 				 NIP6(iph6->daddr),
 				 iph6->flow_lbl[0] & 0x0f,

-- 
YOSHIFUJI Hideaki @ USAGI Project  <yoshfuji@linux-ipv6.org>
GPG-FP  : 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Re: [PATCH net-2.6/stable] [XFRM] AUDIT: Fix flowlabel text format.

[David Miller]

From: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>
Date: Sun, 27 Apr 2008 12:24:18 +0900 (JST)

> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

You'll have to be more specific than just saying "fixed"
when you submit a patch like this.

What about the format is it fixing?

Also, can this possibly break existing audit log scanning
tools and parsers?

Re: [PATCH net-2.6/stable] [XFRM] AUDIT: Fix flowlabel text format.

[YOSHIFUJI Hideaki / 吉藤英明]

In article <20080426.202558.208247674.davem@davemloft.net> (at Sat, 26 Apr 2008 20:25:58 -0700 (PDT)), David Miller <davem@davemloft.net> says:

> From: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>
> Date: Sun, 27 Apr 2008 12:24:18 +0900 (JST)
> 
> > Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
> 
> You'll have to be more specific than just saying "fixed"
> when you submit a patch like this.
> 
> What about the format is it fixing?

Sorry...

> Also, can this possibly break existing audit log scanning
> tools and parsers?

James?

We could add "flowlabel", but it is possible to break something, too.
Anyway, because the log format did not make sense as audit log,
we need to fix it.

---
[XFRM] AUDIT: Fix flowlabel text format ambibuity.

Flowlabel text format was not correct and thus ambiguous.
For example, 0x00123 or 0x01203 are formatted as 0x123.
This is not what audit tools want.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

---
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5dcc10b..fac27ce 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2112,7 +2112,7 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
 		iph6 = ipv6_hdr(skb);
 		audit_log_format(audit_buf,
 				 " src=" NIP6_FMT " dst=" NIP6_FMT
-				 " flowlbl=0x%x%x%x",
+				 " flowlbl=0x%x%02x%02x",
 				 NIP6(iph6->saddr),
 				 NIP6(iph6->daddr),
 				 iph6->flow_lbl[0] & 0x0f,

-- 
YOSHIFUJI Hideaki @ USAGI Project  <yoshfuji@linux-ipv6.org>
GPG-FP  : 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Re: [PATCH net-2.6/stable] [XFRM] AUDIT: Fix flowlabel text format.

[David Miller]

From: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>
Date: Sun, 27 Apr 2008 12:54:37 +0900 (JST)

> In article <20080426.202558.208247674.davem@davemloft.net> (at Sat, 26 Apr 2008 20:25:58 -0700 (PDT)), David Miller <davem@davemloft.net> says:
> 
> > What about the format is it fixing?
> 
> Sorry...

I now understand the problem with the new changelog message.

> > Also, can this possibly break existing audit log scanning
> > tools and parsers?
> 
> James?
> 
> We could add "flowlabel", but it is possible to break something, too.
> Anyway, because the log format did not make sense as audit log,
> we need to fix it.
> 
> ---
> [XFRM] AUDIT: Fix flowlabel text format ambibuity.
> 
> Flowlabel text format was not correct and thus ambiguous.
> For example, 0x00123 or 0x01203 are formatted as 0x123.
> This is not what audit tools want.
> 
> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Patch applied, James if you have some objections let me know,
otherwise I'll toss this to -stable too.

Thanks!

Re: [PATCH net-2.6/stable] [XFRM] AUDIT: Fix flowlabel text format.

[James Morris]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1212 bytes --]

On Sat, 26 Apr 2008, David Miller wrote:

> From: YOSHIFUJI Hideaki / 

Re: [PATCH net-2.6/stable] [XFRM] AUDIT: Fix flowlabel text format.

[Paul Moore]

On Saturday 26 April 2008 11:54:37 pm YOSHIFUJI Hideaki / 吉藤英明 wrote:
> [XFRM] AUDIT: Fix flowlabel text format ambibuity.
>
> Flowlabel text format was not correct and thus ambiguous.
> For example, 0x00123 or 0x01203 are formatted as 0x123.
> This is not what audit tools want.
>
> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Thanks for catching this.

I'm CC'ing the audit list on this because they get nervous when people 
start changing the audit records.  However, I'll ack this patch because 
I think the previous behavior was incorrect and this should be 
considered a bugfix.

Acked-by: Paul Moore <paul.moore@hp.com>

> ---
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index 5dcc10b..fac27ce 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -2112,7 +2112,7 @@ static void xfrm_audit_helper_pktinfo(struct
> sk_buff *skb, u16 family, iph6 = ipv6_hdr(skb);
>  		audit_log_format(audit_buf,
>  				 " src=" NIP6_FMT " dst=" NIP6_FMT
> -				 " flowlbl=0x%x%x%x",
> +				 " flowlbl=0x%x%02x%02x",
>  				 NIP6(iph6->saddr),
>  				 NIP6(iph6->daddr),
>  				 iph6->flow_lbl[0] & 0x0f,

-- 
paul moore
linux @ hp

Re: [PATCH net-2.6/stable] [XFRM] AUDIT: Fix flowlabel text format.

[Eric Paris]

On Mon, 2008-04-28 at 10:14 -0400, Paul Moore wrote:
> On Saturday 26 April 2008 11:54:37 pm YOSHIFUJI Hideaki / 吉藤英明 wrote:
> > [XFRM] AUDIT: Fix flowlabel text format ambibuity.
> >
> > Flowlabel text format was not correct and thus ambiguous.
> > For example, 0x00123 or 0x01203 are formatted as 0x123.
> > This is not what audit tools want.
> >
> > Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
> 
> Thanks for catching this.
> 
> I'm CC'ing the audit list on this because they get nervous when people 
> start changing the audit records.  However, I'll ack this patch because 
> I think the previous behavior was incorrect and this should be 
> considered a bugfix.
> 
> Acked-by: Paul Moore <paul.moore@hp.com>

If you as the user of the audit system understand how that message is
being used its totally up to you to when it is safe and not safe to
change it.  I only get nervous when the audit system itself wants to
make/force changes to users of the subsystem.

Acked-by: Eric Paris <eparis@redhat.com>

-Eric


> 
> > ---
> > diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> > index 5dcc10b..fac27ce 100644
> > --- a/net/xfrm/xfrm_state.c
> > +++ b/net/xfrm/xfrm_state.c
> > @@ -2112,7 +2112,7 @@ static void xfrm_audit_helper_pktinfo(struct
> > sk_buff *skb, u16 family, iph6 = ipv6_hdr(skb);
> >  		audit_log_format(audit_buf,
> >  				 " src=" NIP6_FMT " dst=" NIP6_FMT
> > -				 " flowlbl=0x%x%x%x",
> > +				 " flowlbl=0x%x%02x%02x",
> >  				 NIP6(iph6->saddr),
> >  				 NIP6(iph6->daddr),
> >  				 iph6->flow_lbl[0] & 0x0f,
>