Re: [ULOGD PATCH 08/14] Add state option to NFLOG input plugin.

[Eric Leblond <eric@inl.fr>]

[-- Attachment #1: Type: text/plain, Size: 1758 bytes --]

Hello,

On Tuesday, 2008 April  8 at  1:56:52 +0200, Pablo Neira Ayuso wrote:
> Eric Leblond wrote:
> > On Saturday, 2008 April  5 at 17:10:59 +0200, Pablo Neira Ayuso wrote:
> >> Eric Leblond wrote:
> >>> This patch adds support for "state" option to the NFLOG plugin. For example, it
> >>> can be used by another module to determine if the packet has been dropped,
> >>> rejected or accepted.
> >> What is the exact purpose of the "state" option? The use of the term
> >> "state" for this seems to me a bit confusing as users may think that it
> >>  is related with "stateful filtering". Please, develop the idea a bit more.
> > 
> > Hmm, you are quiet right, 'state' may be a bad choice. In fact, the idea is to
> > be able to give a context relative to the logging. For example, I
> > planned to use it with:
> >  if state = 0 then packet has been dropped (typical -j NFLOG followed by -j DROP)
> >  if state = 1 then this is -j NFLOG followed by -j ACCEPT
> > With that usage choice, the word 'decision' would be better than 'state'.
> > 
> > I think other people may think to other usage. For example, it could be
> > used to indicate the severity of the logged "attack". In this case, the
> > 'decision' keyword is not really a good choice.
> 
> I see, however, why isn't --nflog-prefix enough to label the logs from
> iptables?

Yes, but it forces user to define a system to be able to know if
decision is DROP or ACCEPT. For example, all prefix have to be labelled
like [DA]:$MYSTRING. Well, it works but it overload prefix which is less
human readable. Furthermore, it steals some bits in the prefix field
which is in ULOG rather small.

BR,
-- 
Eric Leblond
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]