Re: [libnetfilter_queue PATCH 1/2] doxygen: improve fail-open documentation.

Re: [libnetfilter_queue PATCH 1/2] doxygen: improve fail-open documentation.

[Neal Murphy]

On Sunday, January 13, 2013 05:49:35 PM you wrote:

> + * results in the system being able to handle high network load but at
> + * the depend of the control on the packets.

Might you have meant to say, "... but at the expense of control of the
packets." ?

N

Re: [libnetfilter_queue PATCH 1/2] doxygen: improve fail-open documentation.

[Pablo Neira Ayuso]

Hi Neal,

On Sun, Jan 13, 2013 at 06:40:30PM -0500, Neal Murphy wrote:
> On Sunday, January 13, 2013 05:49:35 PM you wrote:
> 
> > + * results in the system being able to handle high network load but at
> > + * the depend of the control on the packets.
> 
> Might you have meant to say, "... but at the expense of control of the
> packets." ?

It would be great if you can do more documentation review assuming
you're native English speaker.

The coreteam is a handful of people from France, Germany, Hungary and
Spain doing our best in this lingua franca.

Re: [libnetfilter_queue PATCH 1/2] doxygen: improve fail-open documentation.

[Neal Murphy]

On Thursday, January 17, 2013 07:51:19 PM Pablo Neira Ayuso wrote:
> It would be great if you can do more documentation review assuming
> you're native English speaker.
> 
> The coreteam is a handful of people from France, Germany, Hungary and
> Spain doing our best in this lingua franca.

That's what I figured, and why I phrased it as a question. The translation 
sometimes doesn't quite match what appears to be the thought. But your English 
is a darn sight better than my ham-handed attempts in your language(s) would 
be.

When I see documentation grammar and structure that doesn't, mmm, work well in 
English, I'll gladly suggest improvements, suggest a rewrite if I can make 
sense of it, or request clarification if I can't make sense of it.

Yes, I'm a native speaker. And a stickler for correct grammar, punctuation and 
spelling in my own writings.

N

Re: [libnetfilter_queue PATCH 1/2] doxygen: improve fail-open documentation.

[Eric Leblond]

Hello,

On Sun, 2013-01-13 at 18:40 -0500, Neal Murphy wrote:
> On Sunday, January 13, 2013 05:49:35 PM you wrote:
> 
> > + * results in the system being able to handle high network load but at
> > + * the depend of the control on the packets.
> 
> Might you have meant to say, "... but at the expense of control of the
> packets." ?

Thanks for the correction. I've fixed it in my private repository.

Is there other mistakes in the proposed patches ? If not, I will push
them to the git tree.

BR,
-- 
Eric Leblond <eric@regit.org>
Blog: https://home.regit.org/

Re: libnetfilter_queue issues

[Eric Leblond]

Hello,

On Sun, 2013-01-13 at 12:29 +0100, Pablo Neira Ayuso wrote:
> On Sat, Jan 12, 2013 at 08:04:01PM +0100, Eric Leblond wrote:
> > Hello,
> > 
> > On Sat, 2013-01-12 at 07:23 -0600, Felix wrote:
> > > excellent question !
> > > I too am interested in this.
> > > 
> > > Another similar, related question is do packets that are not filtered
> > > wait on a verdict for a filtered packet?
> > > Again, if not, it means we can change packet order?
> > > If so,it means we can degrade system performance unrelated to our
> > > filtered packets.
> > 
> > I've just wrote an article describing libnetfilter_queue and NFQUEUE. It
> > has been written to answer your questions:
> > https://home.regit.org/netfilter-en/using-nfqueue-and-libnetfilter_queue/
> 
> It would be good to integrate part of this information to the doxygen
> library documentation:
> 
> http://www.netfilter.org/projects/libnetfilter_queue/
> 
> Or simply add reference to Eric's page in the main page of the doxygen.

To follow a small patchset trying to improve libnetfilter_queue doxygen
documentation.

BR,
-- 
Eric Leblond <eric@regit.org>
Blog: https://home.regit.org/

[libnetfilter_queue PATCH 1/2] doxygen: improve fail-open documentation.

[Eric Leblond]

---
 src/libnetfilter_queue.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/libnetfilter_queue.c b/src/libnetfilter_queue.c
index 9fe9dfa..f93ac66 100644
--- a/src/libnetfilter_queue.c
+++ b/src/libnetfilter_queue.c
@@ -87,6 +87,8 @@
  * (requires Linux kernel >= 2.6.30).
  * - see --queue-balance option in NFQUEUE target for multi-threaded apps
  * (it requires Linux kernel >= 2.6.31).
+ * - consider using fail-open option see nfq_set_queue_flags() (it requires
+ *  Linux kernel >= 3.6)
  */
 
 struct nfq_handle
@@ -620,6 +622,12 @@ int nfq_set_mode(struct nfq_q_handle *qh,
 	flags &= ~NFQA_CFG_F_FAIL_OPEN;
 	err = nfq_set_queue_flags(qh, mask, flags);
 \endverbatim
+ *
+ * If NFQA_CFG_F_FAIL_OPEN is used, the kernel will accept instead of
+ * drop packets that should have been enqueued to a full queue. This
+ * results in the system being able to handle high network load but at
+ * the depend of the control on the packets.
+ *
  * \return -1 on error with errno set appropriately; =0 otherwise.
  */
 int nfq_set_queue_flags(struct nfq_q_handle *qh,
-- 
1.7.10.4