netfilter: nft_log: restrict the log prefix length to 127

First, log prefix will be truncated to NF_LOG_PREFIXLEN-1, i.e. 127, at nf_log_packet(), so the extra part is useless. Second, after adding a log rule with a very very long prefix, we will fail to dump the nft rules after this _special_ one, but acctually, they do exist. For example: # name_65000=$(printf "%0.sQ" {1..65000}) # nft add rule filter output log prefix "$name_65000" # nft add rule filter output counter # nft add rule filter output counter # nft list chain filter output table ip filter { chain output { type filter hook output priority 0; policy accept; } } So now, restrict the log prefix length to NF_LOG_PREFIXLEN-1.

Liping Zhang committed 9 years ago

Commit 5ce6b041 parent b2fbd043 files · +4 −2Browse files

Unified · Split

3 files

include/uapi/linux/netfilter/nf_log.h +2 −0
net/netfilter/nf_log.c +0 −1
net/netfilter/nft_log.c +2 −1

include/uapi/linux/netfilter/nf_log.h+2−0

@@ -9,4 +9,6 @@ · 8 unmodified lines
9	#define NF_LOG_MACDECODE 0x20 /* Decode MAC header */	9	#define NF_LOG_MACDECODE 0x20 /* Decode MAC header */
10	#define NF_LOG_MASK 0x2f	10	#define NF_LOG_MASK 0x2f
11		11
		12	#define NF_LOG_PREFIXLEN 128
		13
12	#endif /* _NETFILTER_NF_LOG_H */	14	#endif /* _NETFILTER_NF_LOG_H */

net/netfilter/nf_log.c+0−1

@@ -13,7 +13,6 @@ · 12 unmodified lines
13	/* Internal logging interface, which relies on the real	13	/* Internal logging interface, which relies on the real
14	LOG target modules */	14	LOG target modules */
15		15
16	#define NF_LOG_PREFIXLEN 128
17	#define NFLOGGER_NAME_LEN 64	16	#define NFLOGGER_NAME_LEN 64
18		17
19	static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly;	18	static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly;

net/netfilter/nft_log.c+2−1

@@ -39,7 +39,8 @@ static void nft_log_eval(const struct nft_expr *expr, · 38 unmodified lines
39		39
40	static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {	40	static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {
41	[NFTA_LOG_GROUP] = { .type = NLA_U16 },	41	[NFTA_LOG_GROUP] = { .type = NLA_U16 },
42	[NFTA_LOG_PREFIX] = { .type = NLA_STRING },	42	[NFTA_LOG_PREFIX] = { .type = NLA_STRING,
		43	.len = NF_LOG_PREFIXLEN - 1 },
43	[NFTA_LOG_SNAPLEN] = { .type = NLA_U32 },	44	[NFTA_LOG_SNAPLEN] = { .type = NLA_U32 },
44	[NFTA_LOG_QTHRESHOLD] = { .type = NLA_U16 },	45	[NFTA_LOG_QTHRESHOLD] = { .type = NLA_U16 },
45	[NFTA_LOG_LEVEL] = { .type = NLA_U32 },	46	[NFTA_LOG_LEVEL] = { .type = NLA_U32 },