From: Pablo Neira Ayuso <pablo@netfilter.org>
To: "Maciej Żenczykowski" <zenczykowski@gmail.com>
Cc: Chenbo Feng <chenbofeng.kernel@gmail.com>,
Linux NetDev <netdev@vger.kernel.org>,
netfilter-devel@vger.kernel.org, kernel-team@android.com,
Lorenzo Colitti <lorenzo@google.com>,
Chenbo Feng <fengc@google.com>
Subject: Re: [PATCH net-next] netfilter: xt_quota: fix the behavior of xt_quota module
Date: Tue, 2 Oct 2018 12:52:20 +0200 [thread overview]
Message-ID: <20181002105220.yyof3qxfege5o6ic@salvia> (raw)
In-Reply-To: <20181002105125.uv7mcitvaalpjueo@salvia>
On Tue, Oct 02, 2018 at 12:51:25PM +0200, Pablo Neira Ayuso wrote:
> On Tue, Oct 02, 2018 at 03:38:24AM -0700, Maciej Żenczykowski wrote:
> > > Well, you will need a kernel + userspace update anyway, right?
> >
> > It's true you need new iptables userspace to *see* during dump and/or
> > manually *set* during restore the remain counter.
> >
> > However, (and I believe Chenbo tested this) just a new kernel is
> > enough to fix the problem of modifications within the table resetting
> > the counter.
> > This is because the data gets copied out of kernel and back into
> > kernel by old iptables without any further modifications.
> > ie. the new kernel not clearing the field on copy to userspace and
> > honouring it on copy to kernel is sufficient.
>
> I see, Willem removed this behaviour in newer kernels. The private
> area is now zeroed, is that what you mean right? So I guess this
> cannot be done transparently.
>
> Anyway, I think the --remain approach to fix this longstanding
> problem from iptables :-).
Argh, broken sentence: I mean, I think it's the way to go for
iptables.
next prev parent reply other threads:[~2018-10-02 17:35 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-02 1:23 [PATCH net-next iptables] Rework the xt_quota module Chenbo Feng
2018-10-02 1:23 ` [PATCH iptables] extensions: libxt_quota: Allow setting the remaining quota Chenbo Feng
2018-10-08 23:16 ` Pablo Neira Ayuso
2018-10-02 1:23 ` [PATCH net-next] netfilter: xt_quota: fix the behavior of xt_quota module Chenbo Feng
2018-10-02 7:59 ` Pablo Neira Ayuso
2018-10-02 8:24 ` Maciej Żenczykowski
2018-10-02 8:25 ` Maciej Żenczykowski
2018-10-02 10:11 ` Pablo Neira Ayuso
2018-10-02 10:15 ` Pablo Neira Ayuso
2018-10-02 10:38 ` Maciej Żenczykowski
2018-10-02 10:51 ` Pablo Neira Ayuso
2018-10-02 10:52 ` Pablo Neira Ayuso [this message]
2018-10-02 17:45 ` Chenbo Feng
2018-10-02 18:15 ` Pablo Neira Ayuso
2018-10-02 18:28 ` Chenbo Feng
2018-10-02 18:43 ` Pablo Neira Ayuso
2018-10-02 22:22 ` Maciej Żenczykowski
2018-10-03 9:19 ` Pablo Neira Ayuso
2018-10-03 9:26 ` Maciej Żenczykowski
2018-10-03 9:28 ` Pablo Neira Ayuso
2018-10-03 15:37 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181002105220.yyof3qxfege5o6ic@salvia \
--to=pablo@netfilter.org \
--cc=chenbofeng.kernel@gmail.com \
--cc=fengc@google.com \
--cc=kernel-team@android.com \
--cc=lorenzo@google.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=zenczykowski@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox