From: Florian Westphal <fw@strlen.de>
To: Patrick McHardy <kaber@trash.net>
Cc: Florian Westphal <fw@strlen.de>, netfilter-devel@vger.kernel.org
Subject: Re: [PATCH 6/6] netfilter: do not omit re-route check on NF_QUEUE verdict
Date: Tue, 18 Jan 2011 16:31:46 +0100 [thread overview]
Message-ID: <20110118153146.GH7849@Chamillionaire.breakpoint.cc> (raw)
In-Reply-To: <4D35AE71.6010301@trash.net>
Patrick McHardy <kaber@trash.net> wrote:
> > However, NF_QUEUE no longer DROPs the skb unconditionally if queueing
> > fails (due to NF_VERDICT_FLAG_QUEUE_BYPASS verdict flag), so the
> > re-route test should also be performed if this flag is set in the
> > verdict.
> >
> > The full test would then look something like
> >
> > && ((ret & NF_VERDICT_MASK) == NF_QUEUE && (ret & NF_VERDICT_FLAG_QUEUE_BYPASS))
> >
> > This is rather ugly, so just remove the NF_QUEUE test altogether.
> >
> > The only effect is that we might perform an unnecessary route lookup
> > in the NF_QUEUE case.
>
> Alternatively we could have nf_queue.c perform the rerouting when
> a packet is marked for queue bypass, just as it already does when
> reinjecting a packet. mangle just needs to check for NF_ACCEPT,
> since that is the only verdict we can return from the table that
> doesn't cause the packet to be dropped or queued.
Good point, thanks!
I'll look into it.
next prev parent reply other threads:[~2011-01-18 15:31 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-16 13:19 [PATCH v2] NFQUEUE v2 target with 'queue bypass' support Florian Westphal
2011-01-16 13:19 ` [PATCH 1/6] netfilter: kconfig: NFQUEUE is useless without NETFILTER_NETLINK_QUEUE Florian Westphal
2011-01-18 14:18 ` Patrick McHardy
2011-01-16 13:19 ` [PATCH 2/6] netfilter: nfnetlink_queue: return error number to caller Florian Westphal
2011-01-18 14:27 ` Patrick McHardy
2011-01-16 13:19 ` [PATCH 3/6] netfilter: nfnetlink_queue: do not free skb on error Florian Westphal
2011-01-18 14:29 ` Patrick McHardy
2011-01-16 13:19 ` [PATCH 4/6] netfilter: reduce NF_VERDICT_MASK to 0xff Florian Westphal
2011-01-18 14:52 ` Patrick McHardy
2011-01-16 13:19 ` [PATCH 5/6] netfilter: allow NFQUEUE bypass if no listener is available Florian Westphal
2011-01-18 15:09 ` Patrick McHardy
2011-01-16 13:19 ` [PATCH 6/6] netfilter: do not omit re-route check on NF_QUEUE verdict Florian Westphal
2011-01-18 15:14 ` Patrick McHardy
2011-01-18 15:31 ` Florian Westphal [this message]
2011-01-19 23:14 ` Florian Westphal
2011-01-20 7:53 ` Patrick McHardy
2011-01-20 9:24 ` Patrick McHardy
-- strict thread matches above, loose matches on Subject: below --
2010-12-26 23:58 [PATCH] NFQUEUE v2 target with 'queue bypass' support Florian Westphal
2010-12-26 23:58 ` [PATCH 6/6] netfilter: do not omit re-route check on NF_QUEUE verdict Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110118153146.GH7849@Chamillionaire.breakpoint.cc \
--to=fw@strlen.de \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).