From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org,
John Stultz <john.stultz@linaro.org>, JP Abgrall <jpa@google.com>
Subject: Re: [PATCH 1/1] netfilter: xtables: add quota support to nfacct
Date: Sat, 21 Dec 2013 09:55:09 +0100 [thread overview]
Message-ID: <20131221085509.GA4230@localhost> (raw)
In-Reply-To: <CANLsYkzoa0E6T8ZGYmKHSPdFyGkLeQw8_dsB_NAJx9YA2qD8uw@mail.gmail.com>
On Fri, Dec 20, 2013 at 01:34:00PM -0700, Mathieu Poirier wrote:
> On 19 December 2013 12:43, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
[...]
> > Thinking again on the event delivery, I think it's better if the
> > nfacct match using the new --quota does not deliver the event itself.
> > You can use libnetfilter_queue instead, eg.
> >
> > iptables -I INPUT -p icmp \
> > -m nfacct icmp --quota 12345 --mode bytes --match-once \
> > -j NFLOG --nflog-prefix "icmp: " --nflog-group 34
> >
> > The --once parameter tells to match only if you just crossed the quota
> > limit (so the event is sent once). The idea is to use nflog to deliver
> > the event, which is way more flexible as it includes useful
> > information.
>
> I'm not against the idea as it is less code for me to write. Is this
> "--match-one" thing already available? If not I'll come up with it.
The --match-once that I propose is specific to nfacct, so you need to
add a new flag to indicate this matching mode and return true only
once for that rule.
> Just to be clear, if "--match-one" isn't specified a message is sent
> each time we try to send a packets and the quota has been reached.
Exactly, in the example I provided above, if no --match-once is
specified, you will get a log message per packet over quota.
next prev parent reply other threads:[~2013-12-21 8:55 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-11 16:53 [PATCH 0/1] Add quota capabilities to nfacct mathieu.poirier
2013-12-11 16:53 ` [PATCH 1/1] netfilter: xtables: add quota support " mathieu.poirier
2013-12-18 9:53 ` Pablo Neira Ayuso
[not found] ` <CANLsYkxMzdFCpJ3456PPd8KsEPi-U70kJDqGv8c3BhCsKY8RiQ@mail.gmail.com>
2013-12-19 19:43 ` Pablo Neira Ayuso
2013-12-20 20:34 ` Mathieu Poirier
2013-12-21 8:55 ` Pablo Neira Ayuso [this message]
2013-12-29 21:53 ` Mathieu Poirier
2013-12-30 17:36 ` Pablo Neira Ayuso
2013-12-30 17:56 ` Mathieu Poirier
2013-12-30 21:46 ` Florian Westphal
2013-12-30 22:17 ` Mathieu Poirier
2013-12-30 23:14 ` Mathieu Poirier
2013-12-30 23:31 ` Florian Westphal
2014-01-03 15:54 ` Pablo Neira Ayuso
2014-01-03 20:38 ` Mathieu Poirier
2014-01-04 2:32 ` Pablo Neira Ayuso
[not found] ` <CANLsYkw4UhBGpUcvO9qqqvgz8j00=E6zojMxxXCsPQhStQtGXg@mail.gmail.com>
2014-01-13 21:50 ` Mathieu Poirier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131221085509.GA4230@localhost \
--to=pablo@netfilter.org \
--cc=john.stultz@linaro.org \
--cc=jpa@google.com \
--cc=mathieu.poirier@linaro.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.