Re: possible issues with blowing up struct ipt_log_info

[Roberto Nibali <ratz@tac.ch>]

>>No, it's fix. And "probing" can easily be done with a large sized prefix,
>  
> As I said, if you want to know the exact value, you have to use an
> algorithm that tries to insert several LOG rules.
> If you want to provide here the best algorithm that does the least
> possible probes in the average case, you're welcome. ;-)

It's a matter either of the Pareto principle or if you prefer best practises.

> While this is an amusing exercise, I would prefer knowing the value
> directly. :-)

Fiddle around with the preprocessor in ipt_LOG.c and have yourself the value
printed out using a new MODULE_PARM_DESC entry :)

>>although I'm a bit astonished as to why someone wouldn't know the prefix size
>>when loading the packet filter ruleset.
>  
> This is a perfect kernel guy assertion. ;-)

No, a rather practical approach, as a matter of fact. See below.

> Can you figure out that 90% of
> Linux users in the world are meant to set up a firewall without even
> knowing what a kernel is? ;-)

Where do you have these numbers from? But this is besides the point. If so,
those users will certainly not use iptables by hand, but a preconfigued script
or even one of the nice GUIs for setting up the rules. The backend can handle
such failures easily, no need to know the size :). And how many of those 90% do
not use standard Linux distributions? Because I bet you 10 bucks that none of
the well-known Linux Distributions is changing the ipt_log_info struct compared
to plain vanilla sources.

> More seriously, I am reguarly asked to install a netfilter-based firewall
> on machines I didn't install myself. And most people are not even
> aware there's a limit for LOG prefix length until they discover
> the "too long (must be under xx chars)" message, believe me.

I believe you.

Best regards,
Roberto Nibali, ratz
-- 
-------------------------------------------------------------
addr://Rathausgasse 31, CH-5001 Aarau  tel://++41 62 823 9355
http://www.terreactive.com             fax://++41 62 823 9356
-------------------------------------------------------------
terreActive AG                       Wir sichern Ihren Erfolg
-------------------------------------------------------------