netfilter: load nf_log_syslog on enabling nf_conntrack_log_invalid
Subsystems (2)
PATCH 1/1 netfilter: load nf_log_syslog on enabling nf_conntrack_log_invalid
From: Lance Yang <[email protected]>
When nf_log_syslog is not loaded, nf_conntrack_log_invalid fails to log invalid packets, leaving users unaware of actual invalid traffic. Improve this by loading nf_log_syslog, similar to how 'iptables -I FORWARD 1 -m conntrack --ctstate INVALID -j LOG' triggers it.
Signed-off-by Zi Li <[email protected]>
Signed-off-by Lance Yang <[email protected]>
--- net/netfilter/nf_conntrack_standalone.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_standalone.c +19 -1
@@ -543,6 +543,24 @@ nf_conntrack_hash_sysctl(const struct ctl_table *table, int write,return ret; } +static int +nf_conntrack_log_invalid_sysctl (const struct ctl_table *table,int write, +void *buffer,size_t *lenp,loff_t *ppos) +{ +int ret; + + ret =proc_dou8vec_minmax (table, write, buffer, lenp, ppos); +if (ret <0 || !write) +return ret; + +if (*(u8 *)table->data ==0 ) +return ret; + +request_module ("%s" ,"nf_log_syslog" ); + +return ret; +} +static struct ctl_table_header *nf_ct_netfilter_header;enum nf_ct_sysctl_index {
@@ -649,7 +667,7 @@ static struct ctl_table nf_ct_sysctl_table[] = { .data = &init_net.ct.sysctl_log_invalid, .maxlen = sizeof(u8), .mode = 0644, - .proc_handler = proc_dou8vec_minmax, + .proc_handler = nf_conntrack_log_invalid_sysctl, }, [NF_SYSCTL_CT_EXPECT_MAX] = { .procname = "nf_conntrack_expect_max",
Signature · 1 line
2.49.0