[PATCH] ipt_ULOG delays packets caught by filter

[PATCH] ipt_ULOG delays packets caught by filter

[ruby joker]

[-- Attachment #1: Type: text/plain, Size: 709 bytes --]

Hi!

I want once again bring your attention to ipt_ULOG problem I described
in my previous post [1]. There was no response, still I think problem
is too serious to leave it. Christopher J. Oliver's case [2] shows
the similar behaviour. Maybe bug is hard to notice but it decrease
ulog reliability.

Please correct me if I'm wrong.

Patch was attached to my first mail [1].

[1] http://lists.netfilter.org/pipermail/netfilter-devel/2004-June/015860.html
[2] http://lists.gnumonks.org/pipermail/ulogd/2001-October/000034.html

Regards,
rj
-- 
 . o .       >>  http://joker.linuxstuff.pl  <<
 . . o   It's easier to get forgiveness for being wrong
 o o o   than forgiveness for being right.

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [PATCH] ipt_ULOG delays packets caught by filter

[Pablo Neira]

[-- Attachment #1: Type: text/plain, Size: 454 bytes --]

Hi,

ruby joker wrote:

>Maybe bug is hard to notice but it decrease ulog reliability.
>[1] http://lists.netfilter.org/pipermail/netfilter-devel/2004-June/015860.html
>  
>

I think that this behaviour is related to the default qthreshold value. 
If I'm not wrong, we could fix this problem setting the default value to 
0 instead of 1. In that case we need to update the iptables man page. If 
I'm missing something, please let me know.

regards,
Pablo

[-- Attachment #2: ulog.patch --]
[-- Type: text/x-patch, Size: 368 bytes --]

diff -u -r1.1.1.1 ipt_ULOG.h
--- a/include/linux/netfilter_ipv4/ipt_ULOG.h	11 May 2004 13:35:40 -0000	1.1.1.1
+++ b/include/linux/netfilter_ipv4/ipt_ULOG.h	20 Jul 2004 00:34:30 -0000
@@ -12,7 +12,7 @@
 #endif
 
 #define ULOG_DEFAULT_NLGROUP	1
-#define ULOG_DEFAULT_QTHRESHOLD	1
+#define ULOG_DEFAULT_QTHRESHOLD	0
 
 #define ULOG_MAC_LEN	80
 #define ULOG_PREFIX_LEN	32

[-- Attachment #3: man.patch --]
[-- Type: text/x-patch, Size: 658 bytes --]

Index: libipt_ULOG.man
===================================================================
RCS file: /cvspublic/iptables/extensions/libipt_ULOG.man,v
retrieving revision 1.1
diff -u -r1.1 libipt_ULOG.man
--- libipt_ULOG.man	22 Jan 2004 15:04:24 -0000	1.1
+++ libipt_ULOG.man	20 Jul 2004 00:55:33 -0000
@@ -22,6 +22,6 @@
 .BI "--ulog-qthreshold " "size"
 Number of packet to queue inside kernel.  Setting this value to, e.g. 10
 accumulates ten packets inside the kernel and transmits them as one
-netlink multipart message to userspace.  Default is 1 (for backwards
+netlink multipart message to userspace.  Default is 0 (for backwards
 compatibility).
 .br

Re: [PATCH] ipt_ULOG delays packets caught by filter

[Pablo Neira]

Pablo Neira wrote:

> Hi,
>
> ruby joker wrote:
>
>> Maybe bug is hard to notice but it decrease ulog reliability.
>> [1] 
>> http://lists.netfilter.org/pipermail/netfilter-devel/2004-June/015860.html 
>>
>>  
>>
>
> I think that this behaviour is related to the default qthreshold 
> value. If I'm not wrong, we could fix this problem setting the default 
> value to 0 instead of 1. In that case we need to update the iptables 
> man page. If I'm missing something, please let me know.


please forget this comment, I was under a wrong impression.

regards,
Pablo

Re: [PATCH] ipt_ULOG delays packets caught by filter

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 916 bytes --]

On Tue, Jul 20, 2004 at 02:10:21AM +0200, ruby joker wrote:
> Hi!
> 
> I want once again bring your attention to ipt_ULOG problem I described
> in my previous post [1]. There was no response, still I think problem
> is too serious to leave it. Christopher J. Oliver's case [2] shows
> the similar behaviour. Maybe bug is hard to notice but it decrease
> ulog reliability.

I am well aware of this problem, and I do by no means consider it as
important as to push it into 2.6.8-rc2.  The patch is pending for 2.6.9

> Regards,
> rj
-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]