Re: [PATCH] extensions: libxt_hashlimit: Do not print default timeout and burst

On Wed, Dec 27, 2017 at 10:31:04AM +1100, Duncan Roe wrote: > On Tue, Dec 19, 2017 at 08:20:31PM +0530, Harsha Sharma wrote: > > On Tue, Dec 19, 2017 at 7:31 PM, Pablo Neira Ayuso > > wrote: > > > On Tue, Dec 19, 2017 at 05:57:16PM +0530, Harsha Sharma wrote: > > >> @@ -1340,7 +1345,9 @@ static i

Re: You will definetely be interested...

Hi Dear, Reading your profile has given me courage in search of a reasponsable and trust worthy Fellow. The past has treated me so awfully but now I am ready to move on despite of my health condition. I will like to have a sincere and important discussion with you that will be in your favor likewi

Re: [PATCH] extensions: libxt_hashlimit: Do not print default timeout and burst

On Wed, Dec 27, 2017 at 10:31:04AM +1100, Duncan Roe wrote: > On Tue, Dec 19, 2017 at 08:20:31PM +0530, Harsha Sharma wrote: > > On Tue, Dec 19, 2017 at 7:31 PM, Pablo Neira Ayuso > > wrote: > > > On Tue, Dec 19, 2017 at 05:57:16PM +0530, Harsha Sharma wrote: > > >> @@ -1340,7 +1345,9 @@ static i

Re: [RFC] Can someone please review my latest wiki update

Hi Pablo, On Mon, Dec 18, 2017 at 10:48:16AM +0100, Pablo Neira Ayuso wrote: > Hi Duncan, > > On Sat, Dec 16, 2017 at 08:22:10PM +1100, Duncan Roe wrote: > > Hi, > > > > For those who contribute to the wiki: > > > > I updated > > https://wiki.nftables.org/wiki-nftables/index.php/Flow_tables sectio

Re: [RFC] Can someone please review my latest wiki update

On Wed, Dec 27, 2017 at 09:38:13PM +1100, Duncan Roe wrote: > Hi Pablo, > > On Mon, Dec 18, 2017 at 10:48:16AM +0100, Pablo Neira Ayuso wrote: > > Hi Duncan, > > > > On Sat, Dec 16, 2017 at 08:22:10PM +1100, Duncan Roe wrote: > > > Hi, > > > > > > For those who contribute to the wiki: > > > > > >

[PATCH nf-next,v4 2/7] netfilter: move checksum_partial indirection to struct nf_ipv6_ops

We cannot make a direct call to nf_ip6_checksum_partial() because that would result in autoloading the 'ipv6' module because of symbol dependencies. Therefore, define checksum_partial indirection in nf_ipv6_ops where this really belongs to. For IPv4, we can indeed make a direct function call, whi

[PATCH nf-next,v4 1/7] netfilter: move checksum indirection to struct nf_ipv6_ops

We cannot make a direct call to nf_ip6_checksum() because that would result in autoloading the 'ipv6' module because of symbol dependencies. Therefore, define checksum indirection in nf_ipv6_ops where this really belongs to. For IPv4, we can indeed make a direct function call, which is faster, giv

[PATCH nf-next,v4 0/7] get rid of struct nf_afinfo

This patch gets rid of the struct nf_afinfo abstraction [1]. Previous patchset version was flawed with CONFIG_NETFILTER=y and CONFIG_INET=n which is valid combination too. Send a new version to address problems that have been spotted by the kbuild robot. [1] https://marc.info/?l=netfilter-devel&

[PATCH nf-next,v4 7/7] netfilter: remove struct nf_afinfo and its helper functions

This abstraction has no clients anymore, remove it. Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter.h | 13 - net/bridge/netfilter/nf_tables_bridge.c | 16 net/ipv4/netfilter.c| 10 -- net/ipv6/netfilter.c

[PATCH nf-next,v4 5/7] netfilter: move reroute indirection to struct nf_ipv6_ops

We cannot make a direct call to nf_ip6_reroute() because that would result in autoloading the 'ipv6' module because of symbol dependencies. Therefore, define reroute indirection in nf_ipv6_ops where this really belongs to. For IPv4, we can indeed make a direct function call, which is faster, given

[PATCH nf-next,v4 4/7] netfilter: move route indirection to struct nf_ipv6_ops

We cannot make a direct call to nf_ip6_route() because that would result in autoloading the 'ipv6' module because of symbol dependencies. Therefore, define route indirection in nf_ipv6_ops where this really belongs to. For IPv4, we can indeed make a direct function call, which is faster, given IPv

[PATCH nf-next,v4 3/7] netfilter: remove saveroute indirection in struct nf_afinfo

This is only used by nf_queue.c and this function comes with no symbol dependencies with IPv6, it just refers to structure layouts. Therefore, we can replace it by a direct function call from where it belongs. Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter.h | 2 --

[PATCH nf-next,v4 6/7] netfilter: remove route_key_size field in struct nf_afinfo

This is only needed by nf_queue, place this code where it belongs. Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter.h | 1 - net/ipv4/netfilter.c | 1 - net/ipv6/netfilter.c | 1 - net/netfilter/nf_queue.c | 22 -- 4 files changed, 16 insertions(+),

Re: lost connection to test machine (3)

On Wed, Dec 27, 2017 at 7:18 PM, syzbot wrote: > Hello, > > syzkaller hit the following crash on > beacbc68ac3e23821a681adb30b45dc55b17488d > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is a

Re: lost connection to test machine (3)

Dmitry Vyukov wrote: > On Wed, Dec 27, 2017 at 7:18 PM, syzbot > wrote: > > Hello, > > > > syzkaller hit the following crash on > > beacbc68ac3e23821a681adb30b45dc55b17488d > > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > > compiler: gcc (GCC) 7.1.1 20170620 > > .conf

Re: [PATCH] extensions: libxt_hashlimit: Do not print default timeout and burst

On Wed, Dec 27, 2017 at 12:13:26PM +0100, Pablo Neira Ayuso wrote: > On Wed, Dec 27, 2017 at 10:31:04AM +1100, Duncan Roe wrote: > > On Tue, Dec 19, 2017 at 08:20:31PM +0530, Harsha Sharma wrote: > > > On Tue, Dec 19, 2017 at 7:31 PM, Pablo Neira Ayuso > > > wrote: > > > > On Tue, Dec 19, 2017 at

[PATCH v2] extensions: libxt_hashlimit: Do not print default timeout and burst

Do not print timeout and burst in case default values are used. For e.g. iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200/sec --hashlimit-mode srcip,dstport --hashlimit-name http1 -j DROP nft add rule ip filter INPUT tcp dport 80 flow table http1 { tcp dport