On Thu, Oct 26, 2017 at 12:45:36AM +0200, Florian Westphal wrote:
> Anders K. Pedersen | Cohaesio <akp@xxxxxxxxxxxx> wrote:
> > On ons, 2017-10-25 at 20:20 +0200, Anders K. Pedersen | Cohaesio wrote:
> > > On ons, 2017-10-25 at 19:57 +0200, Florian Westphal wrote:
> > > > Anders K. Pedersen | Cohaesio <akp@xxxxxxxxxxxx> wrote:
[...]
> > > As mentioned, it's not consistent. A rule that has worked fine could
> > > suddenly stop working without any rule set changes for days. Some
> > > times
> > > it has helped to just reload the exact same rule set. Other times
> > > changing
> > >
> > > tcp dport { imap2, imaps } flow table imap \
> > > { ip saddr & 255.255.255.240 \
> > > timeout 5m limit rate 10/minute } \
> > > counter accept
> > >
> > > to
> > >
> > > tcp dport { imap2, imaps } flow table imap \
> > > counter accept
> > >
> > > or
> > >
> > > tcp dport { domain, http, https, 8080, 8443, 9091 } \
> > > meta iif eth1 accept
> > >
> > > to
> > >
> > > tcp dport { domain, http, https, 8080, 8443, 9091 } \
> > > meta iif eth1 counter accept
> > >
> > > has resolved it, but it feels like it wasn't really due to the
> > > changes,
> > > but more random luck.
>
> note that sets are broken with 16bit elements at the moment in 4.13, see
>
> https://patchwork.ozlabs.org/patch/821080/
> or
> https://patchwork.ozlabs.org/patch/830236/
JFYI, the fix for sets is now in nf.git.
https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/
I swear this was included in the previous batch, but it was not. Sorry
about this. Will send this upstream asap.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
