linux-kernel - Re: [RESEND PATCH 1/1] netfilter: load nf_log_syslog on enabling nf_conntrack_log

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aC23TW08pieLxpsf@strlen.de>
Date: Wed, 21 May 2025 13:21:49 +0200
From: Florian Westphal <fw@...len.de>
To: Pablo Neira Ayuso <pablo@...filter.org>
Cc: Lance Yang <ioworker0@...il.com>, kadlec@...filter.org,
	davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
	pabeni@...hat.com, horms@...nel.org, coreteam@...filter.org,
	linux-kernel@...r.kernel.org, netfilter-devel@...r.kernel.org,
	Zi Li <zi.li@...ux.dev>, Lance Yang <lance.yang@...ux.dev>
Subject: Re: [RESEND PATCH 1/1] netfilter: load nf_log_syslog on enabling
 nf_conntrack_log_invalid

Pablo Neira Ayuso <pablo@...filter.org> wrote:
> I have been beaten by this usability issue in the past, it happens
> since conntrack is loaded on demand.
> 
> Maybe add an inconditionally soft dependency? This is a oneliner patch.
> 
>         MODULE_SOFTDEP("pre: nf_log_syslog");
> 
> Florian, do you prefer this patch (on-demand) or a oneliner to load
> this module when conntrack gets loaded too?
> 
> It is a bit more memory to make it inconditional, but better to expose
> to users this soft dependency via lsmod.
> 
> Thanks.

I don't like this patch or the above because we do have two log
backends, syslog + nflog.

There is no need for 'syslog' to be active for 'log_invalid' to be
useful as long as the system in question has e.g. ulogd running
and listening to nflog messages.

If anything, the modprobe should be done only when no logger
is registered.