* [PATCH] netfilter: fix nf_l4proto_log_invalid to log invalid packets
@ 2019-04-17 16:49 Andrei Vagin
2019-04-17 20:37 ` Florian Westphal
2019-04-22 8:38 ` Pablo Neira Ayuso
0 siblings, 2 replies; 4+ messages in thread
From: Andrei Vagin @ 2019-04-17 16:49 UTC (permalink / raw)
To: Florian Westphal; +Cc: David S. Miller, netfilter-devel, netdev, Andrei Vagin
It doesn't log a packet if sysctl_log_invalid isn't equal to protonum
OR sysctl_log_invalid isn't equal to IPPROTO_RAW. This sentence is
always true. I believe we need to replace OR to AND.
Cc: Florian Westphal <fw@strlen.de>
Fixes: c4f3db1595827 ("netfilter: conntrack: add and use nf_l4proto_log_invalid")
Signed-off-by: Andrei Vagin <avagin@gmail.com>
---
net/netfilter/nf_conntrack_proto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index b9403a266a2e..37bb530d848f 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -55,7 +55,7 @@ void nf_l4proto_log_invalid(const struct sk_buff *skb,
struct va_format vaf;
va_list args;
- if (net->ct.sysctl_log_invalid != protonum ||
+ if (net->ct.sysctl_log_invalid != protonum &&
net->ct.sysctl_log_invalid != IPPROTO_RAW)
return;
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] netfilter: fix nf_l4proto_log_invalid to log invalid packets
2019-04-17 16:49 [PATCH] netfilter: fix nf_l4proto_log_invalid to log invalid packets Andrei Vagin
@ 2019-04-17 20:37 ` Florian Westphal
2019-04-22 8:38 ` Pablo Neira Ayuso
1 sibling, 0 replies; 4+ messages in thread
From: Florian Westphal @ 2019-04-17 20:37 UTC (permalink / raw)
To: Andrei Vagin; +Cc: Florian Westphal, David S. Miller, netfilter-devel, netdev
Andrei Vagin <avagin@gmail.com> wrote:
> diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
> index b9403a266a2e..37bb530d848f 100644
> --- a/net/netfilter/nf_conntrack_proto.c
> +++ b/net/netfilter/nf_conntrack_proto.c
> @@ -55,7 +55,7 @@ void nf_l4proto_log_invalid(const struct sk_buff *skb,
> struct va_format vaf;
> va_list args;
>
> - if (net->ct.sysctl_log_invalid != protonum ||
> + if (net->ct.sysctl_log_invalid != protonum &&
> net->ct.sysctl_log_invalid != IPPROTO_RAW)
Urgh, thanks for fixing this.
Acked-by: Florian Westphal <fw@strlen.de>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] netfilter: fix nf_l4proto_log_invalid to log invalid packets
2019-04-17 16:49 [PATCH] netfilter: fix nf_l4proto_log_invalid to log invalid packets Andrei Vagin
2019-04-17 20:37 ` Florian Westphal
@ 2019-04-22 8:38 ` Pablo Neira Ayuso
2019-04-30 6:38 ` Dexuan-Linux Cui
1 sibling, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2019-04-22 8:38 UTC (permalink / raw)
To: Andrei Vagin; +Cc: Florian Westphal, David S. Miller, netfilter-devel, netdev
On Wed, Apr 17, 2019 at 09:49:44AM -0700, Andrei Vagin wrote:
> It doesn't log a packet if sysctl_log_invalid isn't equal to protonum
> OR sysctl_log_invalid isn't equal to IPPROTO_RAW. This sentence is
> always true. I believe we need to replace OR to AND.
Applied, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] netfilter: fix nf_l4proto_log_invalid to log invalid packets
2019-04-22 8:38 ` Pablo Neira Ayuso
@ 2019-04-30 6:38 ` Dexuan-Linux Cui
0 siblings, 0 replies; 4+ messages in thread
From: Dexuan-Linux Cui @ 2019-04-30 6:38 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Andrei Vagin, Florian Westphal, David S. Miller, netfilter-devel,
netdev, Dexuan Cui
On Mon, Apr 22, 2019 at 1:40 AM Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>
> On Wed, Apr 17, 2019 at 09:49:44AM -0700, Andrei Vagin wrote:
> > It doesn't log a packet if sysctl_log_invalid isn't equal to protonum
> > OR sysctl_log_invalid isn't equal to IPPROTO_RAW. This sentence is
> > always true. I believe we need to replace OR to AND.
>
> Applied, thanks.
I also happened to find this bug today.
I almost can not believe I'm the second guy to notice the issue -- the
bug has been there for 1 year and a half...
Anyway, I'm glad to see that Andrei fixed it!
-- Dexuan
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-04-30 6:38 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-04-17 16:49 [PATCH] netfilter: fix nf_l4proto_log_invalid to log invalid packets Andrei Vagin
2019-04-17 20:37 ` Florian Westphal
2019-04-22 8:38 ` Pablo Neira Ayuso
2019-04-30 6:38 ` Dexuan-Linux Cui
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox