Re: [PATCH]: drop packet without verdict from nfqueue after timeout

[Eric Leblond <eric@inl.fr>]

[-- Attachment #1: Type: text/plain, Size: 1374 bytes --]

Hi,

Le lundi 23 mars 2009 à 20:18 +0100, Patrick McHardy a écrit :
> Kuzin Andrey wrote:
> > This is patch for problem with stucked packets in nf_queue if
> > something going wrong in userspace program. Automatically drop packets
> > without any verdict after timeout defined by NFQNL_TIMEOUT_ENTRY_DROP.
> 
> There's a very easy and cheap way to handle this. The packets have
> sequence numbers and userspace should issues verdicts in ascending
> order anyways to avoid reordering. Just add something that will drop
> everything in the queue up to the sequence number contained in the
> netlink message.

I don't think the described mechanism is generic enough to be a default
behaviour. It should be useful for projects like snort-inline but it
will really a problem for software like NuFW which are asynchronous by
design.

In NuFW, packet authentication is triggered by a user message (signing
of packet is done is userspace). Thus the ordering of the answer depends
of the ordering of user messages. As NuFW authenticate packet at network
scale (there is thus plenty of users), it is not possible to assume that
the answer will be ordered.

Thus, even if it could be useful, this mechanism should only be
activated by an explicit userspace query. 

BR,
-- 
Eric Leblond <eric@inl.fr>
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]