netdev - Re: kernel v4.8: iptables logs are truncated with the 4.8 kernel?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 Oct 2016 03:57:52 +0000 (UTC)
From:   Chris Caputo <ccaputo@....net>
To:     Liping Zhang <zlpnobody@...il.com>
cc:     Vishwanath Pai <vpai@...mai.com>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Justin Piszcz <jpiszcz@...idpixels.com>,
        linux-kernel@...r.kernel.org,
        Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: kernel v4.8: iptables logs are truncated with the 4.8 kernel?

On Tue, 11 Oct 2016, Liping Zhang wrote:
> Yes, thanks for clarifying this. There's a bug in kernel, can you try
> this patch:
> 
> diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
> index 018eed7..8c069b4 100644
> --- a/net/netfilter/xt_NFLOG.c
> +++ b/net/netfilter/xt_NFLOG.c
> @@ -32,6 +32,7 @@ nflog_tg(struct sk_buff *skb, const struct
> xt_action_param *par)
>         li.u.ulog.copy_len   = info->len;
>         li.u.ulog.group      = info->group;
>         li.u.ulog.qthreshold = info->threshold;
> +       li.u.ulog.flags      = 0;
> 
>         if (info->flags & XT_NFLOG_F_COPY_LEN)
>                 li.u.ulog.flags |= NF_LOG_F_COPY_LEN;

I have tested the above patch with 4.8.1, with and without nflog-size 
defined in an iptables configuration, and it works well.

The ulogd-2.0.5 segfaults no longer happen when nflog-size is not present 
in a target.

I recommend this fix.

Thanks,
Chris