Re: [PATCH nf-next v2 1/1] netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Apr 14, 2017 at 07:04:44AM +0800, Gao Feng wrote:
> > -----Original Message-----
> > From: Pablo Neira Ayuso [mailto:pablo@netfilter.org]
> > 
> > On Wed, Apr 12, 2017 at 10:14:50AM +0800, gfree.wind@foxmail.com wrote:
> > >
> > > Current SYNPROXY codes return NF_DROP during normal TCP handshaking,
> > > it is not friendly to caller. Because the nf_hook_slow would treat the
> > > NF_DROP as an error, and return -EPERM.
> > > As a result, it may cause the top caller think it meets one error.
> > >
> > > So use NF_STOLEN instead of NF_DROP now because there is no error
> > > happened indeed, and free the skb directly.
> > 
> > Is this really addressing a real problem? How did you reproduce it?
> 
> We defined the NF_DROP and NF_STOLEN, I think we should use them clearly.
> When NF_DROP happens, it means one error happened.

That's a valid concern. How did you tested this change?

[...]
> Sorry, I always use one command "git format-patch -s -n master..XX"
> according to one document
> whose title is "HOWTO: Create and submit your first Linux kernel patch using
> GIT".
> 
> It generate the "1/1" by default.

There are ways to avoid that. Only you send 1/1 patches.

> I will try to lookup other documents about the patch rule, and correct the
> current command.

OK.

[...]
> More carefully, and don't rush more.

Thank you.