[PATCH] netfilter: xt_physdev: Fix spurious error message in physdev_mt_check

[PATCH] netfilter: xt_physdev: Fix spurious error message in physdev_mt_check

[Todd Seidelmann]

Simplify the check in physdev_mt_check() to emit an error message
only when passed an invalid chain (ie, NF_INET_LOCAL_OUT).
This avoids cluttering up the log with errors against valid rules.

For large/heavily modified rulesets, current behavior can quickly
overwhelm the ring buffer, because this function gets called on
every change, regardless of the rule that was changed.

Signed-off-by: Todd Seidelmann <tseidelmann@linode.com>
---

  net/netfilter/xt_physdev.c | 6 ++----
  1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index ead7c6022208..b92b22ce8abd 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -101,11 +101,9 @@ static int physdev_mt_check(const struct 
xt_mtchk_param *par)
         if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
             (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
              info->invert & XT_PHYSDEV_OP_BRIDGED) &&
-           par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
-           (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
+           par->hook_mask & (1 << NF_INET_LOCAL_OUT)) {
                 pr_info_ratelimited("--physdev-out and --physdev-is-out 
only supported in the FORWARD and POSTROUTING chains with bridged 
traffic\n");
-               if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
-                       return -EINVAL;
+               return -EINVAL;
         }

         if (!brnf_probed) {
--
2.17.1

Re: [PATCH] netfilter: xt_physdev: Fix spurious error message in physdev_mt_check

[Florian Westphal]

Todd Seidelmann <tseidelmann@linode.com> wrote:
> Simplify the check in physdev_mt_check() to emit an error message
> only when passed an invalid chain (ie, NF_INET_LOCAL_OUT).
> This avoids cluttering up the log with errors against valid rules.
> 
> For large/heavily modified rulesets, current behavior can quickly
> overwhelm the ring buffer, because this function gets called on
> every change, regardless of the rule that was changed.

Agreed, we've had this notice long enough, better to only
print it when we reject the rule.

Acked-by: Florian Westphal <fw@strlen.de>

Re: [PATCH] netfilter: xt_physdev: Fix spurious error message in physdev_mt_check

[Pablo Neira Ayuso]

On Wed, Aug 21, 2019 at 11:47:53AM -0400, Todd Seidelmann wrote:
> Simplify the check in physdev_mt_check() to emit an error message
> only when passed an invalid chain (ie, NF_INET_LOCAL_OUT).
> This avoids cluttering up the log with errors against valid rules.
> 
> For large/heavily modified rulesets, current behavior can quickly
> overwhelm the ring buffer, because this function gets called on
> every change, regardless of the rule that was changed.

Applied, comment below.

>  net/netfilter/xt_physdev.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
> index ead7c6022208..b92b22ce8abd 100644
> --- a/net/netfilter/xt_physdev.c
> +++ b/net/netfilter/xt_physdev.c
> @@ -101,11 +101,9 @@ static int physdev_mt_check(const struct xt_mtchk_param
> *par)

Please, fix your MUA, patch is mangled, I have fixed it here this
time, this was not applying via git-am.