Hi, Le lundi 23 mars 2009 à 20:18 +0100, Patrick McHardy a écrit : > Kuzin Andrey wrote: > > This is patch for problem with stucked packets in nf_queue if > > something going wrong in userspace program. Automatically drop packets > > without any verdict after timeout defined by NFQNL_TIMEOUT_ENTRY_DROP. > > There's a very easy and cheap way to handle this. The packets have > sequence numbers and userspace should issues verdicts in ascending > order anyways to avoid reordering. Just add something that will drop > everything in the queue up to the sequence number contained in the > netlink message. I don't think the described mechanism is generic enough to be a default behaviour. It should be useful for projects like snort-inline but it will really a problem for software like NuFW which are asynchronous by design. In NuFW, packet authentication is triggered by a user message (signing of packet is done is userspace). Thus the ordering of the answer depends of the ordering of user messages. As NuFW authenticate packet at network scale (there is thus plenty of users), it is not possible to assume that the answer will be ordered. Thus, even if it could be useful, this mechanism should only be activated by an explicit userspace query. BR, -- Eric Leblond <eric@xxxxxx> INL: http://www.inl.fr/ NuFW: http://www.nufw.org/
Attachment:
signature.asc
Description: Ceci est une partie de message =?ISO-8859-1?Q?num=E9riquement?= =?ISO-8859-1?Q?_sign=E9e?=
