From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org,
John Stultz <john.stultz@linaro.org>, JP Abgrall <jpa@google.com>
Subject: Re: [PATCH 1/1] netfilter: xtables: add quota support to nfacct
Date: Sat, 21 Dec 2013 09:55:09 +0100 [thread overview]
Message-ID: <20131221085509.GA4230@localhost> (raw)
In-Reply-To: <CANLsYkzoa0E6T8ZGYmKHSPdFyGkLeQw8_dsB_NAJx9YA2qD8uw@mail.gmail.com>
On Fri, Dec 20, 2013 at 01:34:00PM -0700, Mathieu Poirier wrote:
> On 19 December 2013 12:43, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
[...]
> > Thinking again on the event delivery, I think it's better if the
> > nfacct match using the new --quota does not deliver the event itself.
> > You can use libnetfilter_queue instead, eg.
> >
> > iptables -I INPUT -p icmp \
> > -m nfacct icmp --quota 12345 --mode bytes --match-once \
> > -j NFLOG --nflog-prefix "icmp: " --nflog-group 34
> >
> > The --once parameter tells to match only if you just crossed the quota
> > limit (so the event is sent once). The idea is to use nflog to deliver
> > the event, which is way more flexible as it includes useful
> > information.
>
> I'm not against the idea as it is less code for me to write. Is this
> "--match-one" thing already available? If not I'll come up with it.
The --match-once that I propose is specific to nfacct, so you need to
add a new flag to indicate this matching mode and return true only
once for that rule.
> Just to be clear, if "--match-one" isn't specified a message is sent
> each time we try to send a packets and the quota has been reached.
Exactly, in the example I provided above, if no --match-once is
specified, you will get a log message per packet over quota.
next prev parent reply other threads:[~2013-12-21 8:55 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-11 16:53 [PATCH 0/1] Add quota capabilities to nfacct mathieu.poirier
2013-12-11 16:53 ` [PATCH 1/1] netfilter: xtables: add quota support " mathieu.poirier
2013-12-18 9:53 ` Pablo Neira Ayuso
[not found] ` <CANLsYkxMzdFCpJ3456PPd8KsEPi-U70kJDqGv8c3BhCsKY8RiQ@mail.gmail.com>
2013-12-19 19:43 ` Pablo Neira Ayuso
2013-12-20 20:34 ` Mathieu Poirier
2013-12-21 8:55 ` Pablo Neira Ayuso [this message]
2013-12-29 21:53 ` Mathieu Poirier
2013-12-30 17:36 ` Pablo Neira Ayuso
2013-12-30 17:56 ` Mathieu Poirier
2013-12-30 21:46 ` Florian Westphal
2013-12-30 22:17 ` Mathieu Poirier
2013-12-30 23:14 ` Mathieu Poirier
2013-12-30 23:31 ` Florian Westphal
2014-01-03 15:54 ` Pablo Neira Ayuso
2014-01-03 20:38 ` Mathieu Poirier
2014-01-04 2:32 ` Pablo Neira Ayuso
[not found] ` <CANLsYkw4UhBGpUcvO9qqqvgz8j00=E6zojMxxXCsPQhStQtGXg@mail.gmail.com>
2014-01-13 21:50 ` Mathieu Poirier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131221085509.GA4230@localhost \
--to=pablo@netfilter.org \
--cc=john.stultz@linaro.org \
--cc=jpa@google.com \
--cc=mathieu.poirier@linaro.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).