Re: possible issues with blowing up struct ipt_log_info

[Herve Eychenne <rv@wallfire.org>]

On Mon, Jul 04, 2005 at 10:20:33AM +0200, Roberto Nibali wrote:

> >>Trying to insert potentially many LOG rules to empirically determine
> >>the maximum prefix length is far less complex, that's for sure. ;-)
> > 
> > Do we already have indeterminate log prefix length? I thought we had
> > one, fixed size, no probing neccessary. Am I wrong?

> No, it's fix. And "probing" can easily be done with a large sized prefix,

As I said, if you want to know the exact value, you have to use an
algorithm that tries to insert several LOG rules.
If you want to provide here the best algorithm that does the least
possible probes in the average case, you're welcome. ;-)

While this is an amusing exercise, I would prefer knowing the value
directly. :-)

> although I'm a bit astonished as to why someone wouldn't know the prefix size
> when loading the packet filter ruleset.

This is a perfect kernel guy assertion. ;-) Can you figure out that 90% of
Linux users in the world are meant to set up a firewall without even
knowing what a kernel is? ;-)
More seriously, I am reguarly asked to install a netfilter-based firewall
on machines I didn't install myself. And most people are not even
aware there's a limit for LOG prefix length until they discover
the "too long (must be under xx chars)" message, believe me.

 Herve

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/