Re: ulogd2/NFLOG: nfnetlink_log: error creating log nlmsg

[Thomas Jacob <jacob@internet24.de>]

On Thu, May 21, 2009 at 07:24:58PM +0200, Pablo Neira Ayuso wrote:
> Thomas Jacob wrote:
> > Bug? Feature? If it's the latter, how can I prevent this from
> > happening?
> 
> Does this patch helps? It seems that we're missing to add the size of
> the hardware address since 2.6.27.

Thanks for the quick reply and the patch. Unfortunately I haven't found a way
to reproduce this problem in a lab environment yet, so I can't confirm
whether or not it does anything. Originally the issue
occurred when hot-replacing an older system with one that
runs NFLOG/ulogd2 and the versions listed, thereby generating lots
of invalid packets probably (which should have been logged) as well
as some intentional drops (Packet rate at the time maybe was 30kpps).

Any hints as to what kind of traffic I should be generating to create
a situation that your patch might be a remedy for ?

   Thanks, 
       Thomas

> -- 
> "Los honestos son inadaptados sociales" -- Les Luthiers

> diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
> index fd326ac..66a6dd5 100644
> --- a/net/netfilter/nfnetlink_log.c
> +++ b/net/netfilter/nfnetlink_log.c
> @@ -581,6 +581,12 @@ nfulnl_log_packet(u_int8_t pf,
>  		+ nla_total_size(sizeof(struct nfulnl_msg_packet_hw))
>  		+ nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp));
>  
> +	if (in && skb_mac_header_was_set(skb)) {
> +		size +=   nla_total_size(skb->dev->hard_header_len)
> +			+ nla_total_size(sizeof(u_int16_t))	/* hwtype */
> +			+ nla_total_size(sizeof(u_int16_t));	/* hwlen */
> +	}
> +
>  	spin_lock_bh(&inst->lock);
>  
>  	if (inst->flags & NFULNL_CFG_F_SEQ)