Re: [PATCH nf] netfilter: nf_tables: Unbreak audit log reset

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On Wed, Sep 6, 2023 at 6:21 PM Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> On Wed, Sep 06, 2023 at 11:39:41PM +0200, Phil Sutter wrote:
> > On Wed, Sep 06, 2023 at 03:56:41PM -0400, Paul Moore wrote:
> [...]
> > > If it is a bug, please submit a fix for this as soon as possible Pablo.
> >
> > Thanks for your support, but I can take over, too. The number of
> > notifications emitted even for a small ruleset is not ideal, also. It's
> > just a bit sad that I ACKed the patch already and so it went out the
> > door. Florian, can we still put a veto there?
> Phil, kernel was crashing after your patch, this was resulting in a
> kernel panic when running tests here. I had to revert your patches
> locally to keep running tests.
> Please, just send an incremental fix to adjust the idx, revert will
> leave things in worse state.

If we can get a fix out soon then I'm fine with that, if we can't get
a fix out soon then a revert may be wise.

> Audit does not show chains either, which is not very useful to locate
> what where exactly the rules have been reset, but that can probably
> discussed in net-next. Richard provided a way to extend this if audit
> maintainer find it useful too.

Richard was correct in saying that new fields must be added to the end
of the record.  The only correction I would make to Richard's comments
is that we tend to prefer that if a field is present in a record, it
is always present in a record; if there is no useful information to
log in that field, a "?" can be substituted for the value (e.g.


[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux