Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ce6b04c authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_log: restrict the log prefix length to 127 



First, log prefix will be truncated to NF_LOG_PREFIXLEN-1, i.e. 127,
at nf_log_packet(), so the extra part is useless.

Second, after adding a log rule with a very very long prefix, we will
fail to dump the nft rules after this _special_ one, but acctually,
they do exist. For example:
  # name_65000=$(printf "%0.sQ" {1..65000})
  # nft add rule filter output log prefix "$name_65000"
  # nft add rule filter output counter
  # nft add rule filter output counter
  # nft list chain filter output
  table ip filter {
      chain output {
          type filter hook output priority 0; policy accept;
      }
  }

So now, restrict the log prefix length to NF_LOG_PREFIXLEN-1.

Fixes: 96518518 ("netfilter: add nftables")
Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b2fbd044

include/uapi/linux/netfilter/nf_log.h

+2 −0
Original line number Diff line number Diff line
@@ -9,4 +9,6 @@ 
#define NF_LOG_MACDECODE	0x20	/* Decode MAC header */

#define NF_LOG_MASK		0x2f



#define NF_LOG_PREFIXLEN	128



#endif /* _NETFILTER_NF_LOG_H */

net/netfilter/nf_log.c

+0 −1
Original line number Diff line number Diff line
@@ -13,7 +13,6 @@ 
/* Internal logging interface, which relies on the real

   LOG target modules */



#define NF_LOG_PREFIXLEN		128

#define NFLOGGER_NAME_LEN		64



static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly;

net/netfilter/nft_log.c

+2 −1
Original line number Diff line number Diff line
@@ -39,7 +39,8 @@ static void nft_log_eval(const struct nft_expr *expr, 


static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {

	[NFTA_LOG_GROUP]	= { .type = NLA_U16 },

	[NFTA_LOG_PREFIX]	= { .type = NLA_STRING },

	[NFTA_LOG_PREFIX]	= { .type = NLA_STRING,

				    .len = NF_LOG_PREFIXLEN - 1 },

	[NFTA_LOG_SNAPLEN]	= { .type = NLA_U32 },

	[NFTA_LOG_QTHRESHOLD]	= { .type = NLA_U16 },

	[NFTA_LOG_LEVEL]	= { .type = NLA_U32 },