extensions: libxt_NFLOG: don't truncate log prefix on print/save

When parsing the rule, use a struct with a layout compatible to that of
struct xt_nflog_info, but with a buffer large enough to contain the
whole 128-character nft prefix.

We always send the nflog-group to the kernel since, for nft, log and
nflog targets are handled by the same kernel module, and are
distinguished by whether they define an nflog-group. Therefore, we must
send the group even if it is zero, or the kernel will configure the
target as a log, not an nflog.

Changes to nft_is_expr_compatible were made since only targets which
have an `nflog-group` are compatible. Since nflog targets are
distinguished by having an nflog-group, we ignore targets without one.

We also set the copy-len flag if the snap-len is set since without this,
iptables will mistake `nflog-size` for `nflog-range`.

Signed-off-by: Kyle Bowman <kbowman@cloudflare.com>
Signed-off-by: Alex Forster <aforster@cloudflare.com>
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
index 4394e8b7c4e8d208c03bed432d5fdb90a1d1ef50..d0d0d558dde43492dda193bf46b94789ac99f622 100644 (file)
--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
@@ -20,8 +20,10 @@
 
 #include <xtables.h>
 
+#include <linux/netfilter/nf_log.h>
 #include <linux/netfilter/xt_comment.h>
 #include <linux/netfilter/xt_limit.h>
+#include <linux/netfilter/xt_NFLOG.h>
 
 #include <libmnl/libmnl.h>
 #include <libnftnl/rule.h>
@@ -580,6 +582,54 @@ static void nft_parse_limit(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
                ctx->h->ops->parse_match(match, ctx->cs);
 }
 
+static void nft_parse_log(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+{
+       struct xtables_target *target;
+       struct xt_entry_target *t;
+       size_t target_size;
+       /*
+        * In order to handle the longer log-prefix supported by nft, instead of
+        * using struct xt_nflog_info, we use a struct with a compatible layout, but
+        * a larger buffer for the prefix.
+        */
+       struct xt_nflog_info_nft {
+               __u32 len;
+               __u16 group;
+               __u16 threshold;
+               __u16 flags;
+               __u16 pad;
+               char  prefix[NF_LOG_PREFIXLEN];
+       } info = {
+               .group     = nftnl_expr_get_u16(e, NFTNL_EXPR_LOG_GROUP),
+               .threshold = nftnl_expr_get_u16(e, NFTNL_EXPR_LOG_QTHRESHOLD),
+       };
+       if (nftnl_expr_is_set(e, NFTNL_EXPR_LOG_SNAPLEN)) {
+               info.len = nftnl_expr_get_u32(e, NFTNL_EXPR_LOG_SNAPLEN);
+               info.flags = XT_NFLOG_F_COPY_LEN;
+       }
+       if (nftnl_expr_is_set(e, NFTNL_EXPR_LOG_PREFIX))
+               snprintf(info.prefix, sizeof(info.prefix), "%s",
+                        nftnl_expr_get_str(e, NFTNL_EXPR_LOG_PREFIX));
+
+       target = xtables_find_target("NFLOG", XTF_TRY_LOAD);
+       if (target == NULL)
+               return;
+
+       target_size = XT_ALIGN(sizeof(struct xt_entry_target)) +
+                     XT_ALIGN(sizeof(struct xt_nflog_info_nft));
+
+       t = xtables_calloc(1, target_size);
+       t->u.target_size = target_size;
+       strcpy(t->u.user.name, target->name);
+       t->u.user.revision = target->revision;
+
+       target->t = t;
+
+       memcpy(&target->t->data, &info, sizeof(info));
+
+       ctx->h->ops->parse_target(target, ctx->cs);
+}
+
 static void nft_parse_lookup(struct nft_xt_ctx *ctx, struct nft_handle *h,
                             struct nftnl_expr *e)
 {
@@ -629,6 +679,8 @@ void nft_rule_to_iptables_command_state(struct nft_handle *h,
                        nft_parse_limit(&ctx, expr);
                else if (strcmp(name, "lookup") == 0)
                        nft_parse_lookup(&ctx, h, expr);
+               else if (strcmp(name, "log") == 0)
+                       nft_parse_log(&ctx, expr);
 
                expr = nftnl_expr_iter_next(iter);
        }

diff --git a/iptables/nft.c b/iptables/nft.c
index e4932a7a33eacdf4c4d6b0a78177e5abb0f28331..72f7cf1315661f16133255452784729da88b0bd6 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -3542,6 +3542,10 @@ static int nft_is_expr_compatible(struct nftnl_expr *expr, void *data)
            nftnl_expr_get_u32(expr, NFTNL_EXPR_LIMIT_FLAGS) == 0)
                return 0;
 
+       if (!strcmp(name, "log") &&
+           nftnl_expr_is_set(expr, NFTNL_EXPR_LOG_GROUP))
+               return 0;
+
        return -1;
 }