On Fri, Apr 14, 2017 at 07:04:44AM +0800, Gao Feng wrote: > > -----Original Message----- > > From: Pablo Neira Ayuso [mailto:pablo@xxxxxxxxxxxxx] > > > > On Wed, Apr 12, 2017 at 10:14:50AM +0800, gfree.wind@xxxxxxxxxxx wrote: > > > > > > Current SYNPROXY codes return NF_DROP during normal TCP handshaking, > > > it is not friendly to caller. Because the nf_hook_slow would treat the > > > NF_DROP as an error, and return -EPERM. > > > As a result, it may cause the top caller think it meets one error. > > > > > > So use NF_STOLEN instead of NF_DROP now because there is no error > > > happened indeed, and free the skb directly. > > > > Is this really addressing a real problem? How did you reproduce it? > > We defined the NF_DROP and NF_STOLEN, I think we should use them clearly. > When NF_DROP happens, it means one error happened. That's a valid concern. How did you tested this change? [...] > Sorry, I always use one command "git format-patch -s -n master..XX" > according to one document > whose title is "HOWTO: Create and submit your first Linux kernel patch using > GIT". > > It generate the "1/1" by default. There are ways to avoid that. Only you send 1/1 patches. > I will try to lookup other documents about the patch rule, and correct the > current command. OK. [...] > More carefully, and don't rush more. Thank you. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
