From: Eric Leblond <eric@inl.fr>
To: Victor Julien <lists@inliniac.net>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: libnetfilter_queue question
Date: Wed, 19 May 2010 22:10:48 +0200 [thread overview]
Message-ID: <1274299848.21477.6.camel@ice-age> (raw)
In-Reply-To: <4BF3BA47.7040109@inliniac.net>
[-- Attachment #1: Type: text/plain, Size: 904 bytes --]
Hi Victor,
Le mercredi 19 mai 2010 à 12:15 +0200, Victor Julien a écrit :
> Hi all,
>
> I'm using libnetfilter_queue for inline mode in the Suricata IDS/IPS
> (www.openinfosecfoundation.org). I'm using a callback that makes the
> packet(s) available to the detection engine. In some special cases the
> call back could fail (only malloc failure atm).
>
> I was wondering what the proper response would be to such an event. I'm
> assuming nfq_handle_packet() would return an (non zero) error code in
> that case.
>
> Should I verdict the packet? (drop to be safe)
Yes, clearly ! If you don't do this the packet will get stuck inside the
kernel and nothing will released it (and free associated structures).
The only other mean to free queued packet is to unregister from the NF
queue.
BR,
--
Eric Leblond <eric@inl.fr>
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/
[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 190 bytes --]
next prev parent reply other threads:[~2010-05-19 20:11 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-05-19 10:15 libnetfilter_queue question Victor Julien
2010-05-19 20:10 ` Eric Leblond [this message]
2010-05-21 16:02 ` Victor Julien
2010-05-27 13:25 ` Victor Julien
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1274299848.21477.6.camel@ice-age \
--to=eric@inl.fr \
--cc=lists@inliniac.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).