bump version to 4.2-3

[pve-firewall.git] / src / pvefw-logger.c

diff --git a/src/pvefw-logger.c b/src/pvefw-logger.c
index 9c6fe4ac7359a22d13536dac90f79e11c934f0f8..f76250516b92b61fc650c26f743520f024c74591 100644 (file)
--- a/src/pvefw-logger.c
+++ b/src/pvefw-logger.c
@@ -1,6 +1,6 @@
 /*
 
-  Copyright (C) 2014 Proxmox Server Solutions GmbH
+  Copyright (C) 2014 - 2021 Proxmox Server Solutions GmbH
 
   This software is written by Proxmox Server Solutions GmbH <support@proxmox.com>
 
@@ -65,7 +65,7 @@ gboolean conntrack = FALSE;
 
 LOG FORMAT:
 
-Special care was taken to allow fast parsing (and filer messages for a singl VM).
+Special care was taken to allow fast parsing and filering messages for a single VM.
 
 <VMID> <LOGLEVEL> <CHAIN> <TIME> <TIMEZONE> <MSG>
 
@@ -575,6 +575,7 @@ print_nexthdr(struct log_entry *le, char *hdr, int payload_len, u_int8_t proto)
             return 0;
 
         struct ip6_ext *exthdr = (struct ip6_ext*)hdr;
+        int ext_len = 0;
 
         switch (proto) {
         /* protocols (these return) */
@@ -601,6 +602,7 @@ print_nexthdr(struct log_entry *le, char *hdr, int payload_len, u_int8_t proto)
                 return -1;
             if (print_fragment(le, (struct ip6_frag*)hdr, payload_len) < 0)
                 return -1;
+            ext_len = sizeof(struct ip6_frag);
             break;
         case IPPROTO_HOPOPTS:
             LEPRINTF("NEXTHDR=HOPOPTS ");
@@ -628,8 +630,12 @@ print_nexthdr(struct log_entry *le, char *hdr, int payload_len, u_int8_t proto)
         /* next header: */
         if (check_ip6ext(le, exthdr, payload_len) < 0)
             return -1;
-        hdr += exthdr->ip6e_len;
-        payload_len -= exthdr->ip6e_len;
+        if(ext_len == 0) {
+            ext_len = (exthdr->ip6e_len+1) * 8;
+        }
+        hdr += ext_len;
+        payload_len -= ext_len;
+        proto = exthdr->ip6e_nxt;
     }
 }
 
@@ -954,8 +960,12 @@ nfct_read_cb(GIOChannel *source,
 {
     int res;
     if ((res = nfct_catch(nfcth)) < 0) {
-        log_status_message(3, "error catching nfct");
-        return FALSE;
+        if (errno == ENOBUFS) {
+            log_status_message(3, "nfct_catch returned ENOBUFS: conntrack information may be incomplete");
+        } else {
+            log_status_message(3, "error catching nfct: %s", strerror(errno));
+            return FALSE;
+        }
     }
     return TRUE;
 }
@@ -1025,11 +1035,11 @@ main(int argc, char *argv[])
     for (int i = 10; i >= 0; i--) {
         if (flock(lockfd, LOCK_EX|LOCK_NB) != 0) {
             if (!i) {
-                fprintf(stderr, "unable to aquire lock '%s': %s\n", LOCKFILE, strerror (errno));
+                fprintf(stderr, "unable to acquire lock '%s': %s\n", LOCKFILE, strerror (errno));
                 exit(-1);
             }
             if (i == 10)
-                fprintf(stderr, "unable to aquire lock '%s' - trying again.\n", LOCKFILE);
+                fprintf(stderr, "unable to acquire lock '%s' - trying again.\n", LOCKFILE);
 
             sleep(1);
         }