From: Phil Sutter <phil@nwl.cc>
To: Jan Engelhardt <jengelh@inai.de>
Cc: Jeremy Sowden <jeremy@azazel.net>,
Netfilter Devel <netfilter-devel@vger.kernel.org>
Subject: Re: [PATCH iptables v2] man: string: document BM false negatives
Date: Fri, 16 Jun 2023 13:32:28 +0200 [thread overview]
Message-ID: <ZIxITN9d5jDJ+r6y@orbyte.nwl.cc> (raw)
In-Reply-To: <6n8s5ns3-768n-q58p-9798-p67s64502358@vanv.qr>
On Sun, Jun 11, 2023 at 02:07:57PM +0200, Jan Engelhardt wrote:
> On Sunday 2023-06-11 13:34, Jeremy Sowden wrote:
>
> > iptables \-p udp \-\-dport 53 \-m string \-\-algo bm \-\-from 40 \-\-to 57 \-\-hex\-string '|03|www|09|netfilter|03|org|00|'
> >+.P
> >+NB since Boyer-Moore (BM) performs searches for matches from right to left and
> >+the kernel may store a packet in multiple discontiguous blocks, it's possible
> >+that a match could be spread over multiple blocks, in which case this algorithm
> >+won't find it.
>
> It was better when it just said "Note" instead of NB (notebook, nota bene)
Applied after s/NB/Note:/, thanks everyone!
prev parent reply other threads:[~2023-06-16 11:32 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-11 8:38 [PATCH iptables] man: string: document BM false negatives Jeremy Sowden
2023-06-11 11:31 ` Jeremy Sowden
2023-06-11 11:34 ` [PATCH iptables v2] " Jeremy Sowden
2023-06-11 12:07 ` Jan Engelhardt
2023-06-16 11:32 ` Phil Sutter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZIxITN9d5jDJ+r6y@orbyte.nwl.cc \
--to=phil@nwl.cc \
--cc=jengelh@inai.de \
--cc=jeremy@azazel.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).