lkml.org 
[lkml]   [2019]   [Sep]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 071/124] netfilter: xt_physdev: Fix spurious error message in physdev_mt_check
    Date
    From: Todd Seidelmann <tseidelmann@linode.com>

    [ Upstream commit 3cf2f450fff304be9cf4868bf0df17f253bc5b1c ]

    Simplify the check in physdev_mt_check() to emit an error message
    only when passed an invalid chain (ie, NF_INET_LOCAL_OUT).
    This avoids cluttering up the log with errors against valid rules.

    For large/heavily modified rulesets, current behavior can quickly
    overwhelm the ring buffer, because this function gets called on
    every change, regardless of the rule that was changed.

    Signed-off-by: Todd Seidelmann <tseidelmann@linode.com>
    Acked-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/xt_physdev.c | 6 ++----
    1 file changed, 2 insertions(+), 4 deletions(-)

    diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
    index ead7c60222086..b92b22ce8abd3 100644
    --- a/net/netfilter/xt_physdev.c
    +++ b/net/netfilter/xt_physdev.c
    @@ -101,11 +101,9 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
    if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
    (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
    info->invert & XT_PHYSDEV_OP_BRIDGED) &&
    - par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
    - (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
    + par->hook_mask & (1 << NF_INET_LOCAL_OUT)) {
    pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
    - if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
    - return -EINVAL;
    + return -EINVAL;
    }

    if (!brnf_probed) {
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-09-20 00:35    [W:4.699 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site