[PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[Liping Zhang]

From: Liping Zhang <liping.zhang@spreadtrum.com>

Justin and Chris spotted that iptables NFLOG target was broken when they
upgraded the kernel to 4.8: "ulogd-2.0.5- IPs are no longer logged" or
"results in segfaults in ulogd-2.0.5".

Because "struct nf_loginfo li;" is a local variable, and flags will be
filled with garbage value, not inited to zero. So if it contains 0x1,
packets will not be logged to the userspace anymore.

Fixes: 7643507fe8b5 ("netfilter: xt_NFLOG: nflog-range does not truncate packets")
Reported-by: Justin Piszcz <jpiszcz@lucidpixels.com>
Reported-by: Chris Caputo <ccaputo@alt.net>
Tested-by: Chris Caputo <ccaputo@alt.net>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
 net/netfilter/xt_NFLOG.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index 018eed7..8668a5c 100644
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -32,6 +32,7 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	li.u.ulog.copy_len   = info->len;
 	li.u.ulog.group	     = info->group;
 	li.u.ulog.qthreshold = info->threshold;
+	li.u.ulog.flags	     = 0;
 
 	if (info->flags & XT_NFLOG_F_COPY_LEN)
 		li.u.ulog.flags |= NF_LOG_F_COPY_LEN;
-- 
2.5.5

RE: [PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[Justin Piszcz]

> -----Original Message-----
> From: Liping Zhang [mailto:zlpnobody@163.com]
> Sent: Tuesday, October 11, 2016 9:04 AM
> To: pablo@netfilter.org
> Cc: netfilter-devel@vger.kernel.org; jpiszcz@lucidpixels.com;
> ccaputo@alt.net; vpai@akamai.com; Liping Zhang
> Subject: [PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet
> 
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> Justin and Chris spotted that iptables NFLOG target was broken when they
> upgraded the kernel to 4.8: "ulogd-2.0.5- IPs are no longer logged" or
> "results in segfaults in ulogd-2.0.5".
> 
> Because "struct nf_loginfo li;" is a local variable, and flags will be
> filled with garbage value, not inited to zero. So if it contains 0x1,
> packets will not be logged to the userspace anymore.
> 
> Fixes: 7643507fe8b5 ("netfilter: xt_NFLOG: nflog-range does not truncate
> packets")
> Reported-by: Justin Piszcz <jpiszcz@lucidpixels.com>
> Reported-by: Chris Caputo <ccaputo@alt.net>
> Tested-by: Chris Caputo <ccaputo@alt.net>
> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
> ---
>  net/netfilter/xt_NFLOG.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
> index 018eed7..8668a5c 100644
> --- a/net/netfilter/xt_NFLOG.c
> +++ b/net/netfilter/xt_NFLOG.c
> @@ -32,6 +32,7 @@ nflog_tg(struct sk_buff *skb, const struct
> xt_action_param *par)
>  	li.u.ulog.copy_len   = info->len;
>  	li.u.ulog.group	     = info->group;
>  	li.u.ulog.qthreshold = info->threshold;
> +	li.u.ulog.flags	     = 0;
> 
>  	if (info->flags & XT_NFLOG_F_COPY_LEN)
>  		li.u.ulog.flags |= NF_LOG_F_COPY_LEN;
> --
> 2.5.5
> 

Hello,

Applied patch against 4.8.1-- good here as well!

Thanks,

Justin.

Re: [PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[Chris Caputo]

Pablo,

Can we get this patch approved?  It is definitely needed for the 4.8.x 
tree and 4.9-rcX and mainline.

Thanks,
Chris

On Tue, 11 Oct 2016, Liping Zhang wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> Justin and Chris spotted that iptables NFLOG target was broken when they
> upgraded the kernel to 4.8: "ulogd-2.0.5- IPs are no longer logged" or
> "results in segfaults in ulogd-2.0.5".
> 
> Because "struct nf_loginfo li;" is a local variable, and flags will be
> filled with garbage value, not inited to zero. So if it contains 0x1,
> packets will not be logged to the userspace anymore.
> 
> Fixes: 7643507fe8b5 ("netfilter: xt_NFLOG: nflog-range does not truncate packets")
> Reported-by: Justin Piszcz <jpiszcz@lucidpixels.com>
> Reported-by: Chris Caputo <ccaputo@alt.net>
> Tested-by: Chris Caputo <ccaputo@alt.net>
> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
> ---
>  net/netfilter/xt_NFLOG.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
> index 018eed7..8668a5c 100644
> --- a/net/netfilter/xt_NFLOG.c
> +++ b/net/netfilter/xt_NFLOG.c
> @@ -32,6 +32,7 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
>  	li.u.ulog.copy_len   = info->len;
>  	li.u.ulog.group	     = info->group;
>  	li.u.ulog.qthreshold = info->threshold;
> +	li.u.ulog.flags	     = 0;
>  
>  	if (info->flags & XT_NFLOG_F_COPY_LEN)
>  		li.u.ulog.flags |= NF_LOG_F_COPY_LEN;
> -- 
> 2.5.5

Re: [PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[Liping Zhang]

2016-10-30 3:04 GMT+08:00 Chris Caputo <ccaputo@alt.net>:
> Pablo,
>
> Can we get this patch approved?  It is definitely needed for the 4.8.x
> tree and 4.9-rcX and mainline.
>
> Thanks,
> Chris
>

Hi,

This patch was already applied, and was upstream to net.git:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=6d19375b58763fefc2f215fb45117d3353ced888

I think you will see this patch in mainline soon.

Re: [PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[Chris Caputo]

On Sun, 30 Oct 2016, Liping Zhang wrote:
> 2016-10-30 3:04 GMT+08:00 Chris Caputo <ccaputo@alt.net>:
> > Can we get this patch approved?  It is definitely needed for the 4.8.x
> > tree and 4.9-rcX and mainline.
> 
> This patch was already applied, and was upstream to net.git:
> https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=6d19375b58763fefc2f215fb45117d3353ced888
> 
> I think you will see this patch in mainline soon.

Greg, any chance this could be picked up for 4.8.6?  (apologies if I am 
out of line)

Thanks,
Chris

Re: [PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[Greg Kroah-Hartman]

On Sun, Oct 30, 2016 at 03:20:25AM +0000, Chris Caputo wrote:
> On Sun, 30 Oct 2016, Liping Zhang wrote:
> > 2016-10-30 3:04 GMT+08:00 Chris Caputo <ccaputo@alt.net>:
> > > Can we get this patch approved?  It is definitely needed for the 4.8.x
> > > tree and 4.9-rcX and mainline.
> > 
> > This patch was already applied, and was upstream to net.git:
> > https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=6d19375b58763fefc2f215fb45117d3353ced888
> > 
> > I think you will see this patch in mainline soon.
> 
> Greg, any chance this could be picked up for 4.8.6?  (apologies if I am 
> out of line)

Looks good, now queued up.

thanks,

greg k-h

[PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[Liping Zhang]

From: Liping Zhang <liping.zhang@spreadtrum.com>

Justin and Chris spotted that iptables NFLOG target was broken when they
upgraded the kernel to 4.8: "ulogd-2.0.5- IPs are no longer logged" or
"results in segfaults in ulogd-2.0.5".

Because "struct nf_loginfo li;" is a local variable, and flags will be
filled with garbage value, not inited to zero. So if it contains 0x1,
packets will not be logged to the userspace anymore.

Fixes: 7643507fe8b5 ("netfilter: xt_NFLOG: nflog-range does not truncate packets")
Reported-by: Justin Piszcz <jpiszcz@lucidpixels.com>
Reported-by: Chris Caputo <ccaputo@alt.net>
Tested-by: Chris Caputo <ccaputo@alt.net>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
 Sorry to redeliver this patch, my mail server told me that it failed.

 net/netfilter/xt_NFLOG.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index 018eed7..8668a5c 100644
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -32,6 +32,7 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	li.u.ulog.copy_len   = info->len;
 	li.u.ulog.group	     = info->group;
 	li.u.ulog.qthreshold = info->threshold;
+	li.u.ulog.flags	     = 0;
 
 	if (info->flags & XT_NFLOG_F_COPY_LEN)
 		li.u.ulog.flags |= NF_LOG_F_COPY_LEN;
-- 
2.5.5

Re: [PATCH nf] netfilter: xt_NFLOG: fix unexpected truncated packet

[Pablo Neira Ayuso]

On Tue, Oct 11, 2016 at 10:26:27PM +0800, Liping Zhang wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> Justin and Chris spotted that iptables NFLOG target was broken when they
> upgraded the kernel to 4.8: "ulogd-2.0.5- IPs are no longer logged" or
> "results in segfaults in ulogd-2.0.5".
> 
> Because "struct nf_loginfo li;" is a local variable, and flags will be
> filled with garbage value, not inited to zero. So if it contains 0x1,
> packets will not be logged to the userspace anymore.

Applied and enqueued for -stable, thanks.