Re: [nftables v0.9.2 | kernel 4.19.93] logging protocols in inet family table require explicit protocol statement?

[Florian Westphal <fw@strlen.de>]

ѽ҉ᶬḳ℠ <vtol@gmx.net> wrote:
> Having perused the WIKI [1] I tried to get protocol specific logging going,
> but ended up with
> 
> * tcp log -> Error: syntax error, unexpected log
> * icmpv6 log -> Error: syntax error, unexpected log
> 
> Only with an explicit protocol statement logging works
> 
> * ip protocol tcp log
> * ip6 nexthdr  icmpv6 log

You mean "log" doesn't work?  (no "tcp" prefix).

> cat /proc/net/netfilter/nf_log
>  0 NONE (nfnetlink_log)
>  1 NONE (nfnetlink_log)
>  2 nf_log_ipv4 (nf_log_ipv4,nfnetlink_log)
>  3 NONE (nfnetlink_log)
>  4 NONE (nfnetlink_log)
>  5 NONE (nfnetlink_log)
>  6 NONE (nfnetlink_log)
>  7 NONE (nfnetlink_log)
>  8 NONE (nfnetlink_log)
>  9 NONE (nfnetlink_log)
> 10 nf_log_ipv6 (nf_log_ipv6,nfnetlink_log)
> 11 NONE (nfnetlink_log)
> 12 NONE (nfnetlink_log)

This means that ipv4 is logged by nf_log_ipv4 and ipv6 via
nf_log_ipv6.  Everything should be working for ipv4, ipv6 and inet
without any further action (provided you want to use printk-based
logging via dmesg rather than nfnetlink).

> Tried with
> 
> echo "nf_log_icmp" > /proc/sys/net/netfilter/nf_log/1

There is no layer 4 logger. nf_log_XXX, where XXX is a l3 protocol
family, i.e.  nf_log_{ipv4,ipv6,arp,bridge} or nfnetlink_log.