On Wed, 2010-07-14 at 13:48 +0200, ext Patrick McHardy wrote: > On 13.07.2010 18:38, Pablo Neira Ayuso wrote: > > On 13/07/10 12:23, Luciano Coelho wrote: > >> On Tue, 2010-07-13 at 10:50 +0200, ext Pablo Neira Ayuso wrote: > >>> On 13/07/10 08:18, Changli Gao wrote: > >>>> On Tue, Jul 13, 2010 at 8:11 AM, Samuel > >>>> Ortiz<sameo@xxxxxxxxxxxxxxx> wrote: > >>>>> > >>>>> The userspace notification Xtables target sends a netlink notification > >>>>> whenever a packet hits the target. Notifications have a label > >>>>> attribute > >>>>> for userspace to match it against a previously set rule. The rules > >>>>> also > >>>>> take a --all option to switch between sending a notification for all > >>>>> packets or for the first one only. > >>>>> Userspace can also send a netlink message to toggle this switch > >>>>> while the > >>>>> target is in place. This target uses the nefilter netlink framework. > >>>>> > >>>>> This target combined with various matches (quota, rateest, etc..) > >>>>> allows > >>>>> userspace to make decisions on interfaces handling. One could for > >>>>> example > >>>>> decide to switch between power saving modes depending on estimated > >>>>> rate > >>>>> thresholds. > >>>>> > >>>> > >>>> It much like the following iptables rules. > >>>> > >>>> iptables -N log_and_drop > >>>> iptables -A log_and_drop -j NFLOG --nflog-group 1 --nflog-prefix > >>>> "log_and_drop" > >>>> iptables -A log_and_drop -j DROP > >>>> > >>>> ... > >>>> iptables ... -m quota --quota-bytes 20000 -j log_and_drop > >>>> ... > >>> > >>> Indeed, this looks to me like something that you can do with NFLOG and > >>> some combination of matches. > >> > >> Is it possible to have the NFLOG send only one notification to the > >> userspace? > > > > Not possible, but you could easily extend NFLOG to implement this > > feature if it's not possible to do what you need with the existing > > matches/targets. This NOTIF infrastructure is redundant and it looks > > like a subset of NFLOG. > > If you're using connection tracking, you can use conntrack marks > to avoid sending more than a single message: > > iptables ... -m connmark --mark 0x1/0x1 -j RETURN > iptables ... -j NFLOG ... > iptables ... -j CONNMARK --set-mark 0x1/0x1 Cool, thanks. It seems that there are lots of possibilities to get this to work, but this is starting to get quite complex. I would still prefer having the NFNOTIF module included, since we would be able to do what we want in a very simple way. It's also probably much more efficient that using several rules, which would increase the CPU usage considerably (in our device we are already reaching the limit of a reasonable CPU resource usage with high throughput WLAN connections). While I agree that it is possible to achieve the NFNOTIF functionality with existing modules, I still think there is a "niche" for such module, because it is very simple, has a very clear purpose and would make the ruleset simpler and more efficient. Does this make any sense? -- Cheers, Luca. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
