From: "Gao Feng" <gfree.wind@foxmail.com>
To: "'Pablo Neira Ayuso'" <pablo@netfilter.org>, <gfree.wind@foxmail.com>
Cc: <netfilter-devel@vger.kernel.org>
Subject: RE: [PATCH nf-next v2 1/1] netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking
Date: Fri, 14 Apr 2017 07:04:44 +0800 [thread overview]
Message-ID: <001201d2b4aa$57bc8ba0$0735a2e0$@foxmail.com> (raw)
In-Reply-To: <20170413215749.GA4208@salvia>
> -----Original Message-----
> From: Pablo Neira Ayuso [mailto:pablo@netfilter.org]
>
> On Wed, Apr 12, 2017 at 10:14:50AM +0800, gfree.wind@foxmail.com wrote:
> >
> > Current SYNPROXY codes return NF_DROP during normal TCP handshaking,
> > it is not friendly to caller. Because the nf_hook_slow would treat the
> > NF_DROP as an error, and return -EPERM.
> > As a result, it may cause the top caller think it meets one error.
> >
> > So use NF_STOLEN instead of NF_DROP now because there is no error
> > happened indeed, and free the skb directly.
>
> Is this really addressing a real problem? How did you reproduce it?
We defined the NF_DROP and NF_STOLEN, I think we should use them clearly.
When NF_DROP happens, it means one error happened.
In this case, when synproxy returns NF_DROP, it would be returned as the
return
value of netif_receive_skb.
And some driver would check the return value, like sb1250-mac.c.
Its function "sbdma_rx_process" checks the return value of
"netif_receive_skb".
dropped = netif_receive_skb(sb);
if (dropped == NET_RX_DROP) {
dev->stats.rx_dropped++;
........
The "NET_RX_DROP" is same as NF_DROP. When return NF_DROP, it would add the
dropped counter.
>
> BTW, your patch title is wrong.
>
> [PATCH nf-next v2 1/1]
> ^^^
>
> This 1/1 is completely useless, please remove it in your follow up
patches.
Sorry, I always use one command "git format-patch -s -n master..XX"
according to one document
whose title is "HOWTO: Create and submit your first Linux kernel patch using
GIT".
It generate the "1/1" by default.
I will try to lookup other documents about the patch rule, and correct the
current command.
>
> Moreover, you should be more careful, *really*, this is not a speed coding
> contest. You tend to send me follow up patch version just hours afterwards
> because you rush too much.
Yes, it is my fault. I would pay more attention on it.
I treated the patch commit as the power which could push me investigate the
kernel codes.
When one commit is accept, it would excite me a lot.
>From now on, I would use the power more carefully, and don't rush more.
>
> Be more careful, use the same email address to send your patches. Drop
quote
> the full email in your replies...
I would drop the quote by manual carefully.
As mentioned in other email, I have to change my email from gmail, and try
to find one which could support text email well recently
More carefully, and don't rush more.
I must follow it.
Best Regards
Feng
>
> Other than that, I may start ignoring your patches, it's too hard to keep
up with
> this.
next prev parent reply other threads:[~2017-04-13 23:04 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-12 2:14 [PATCH nf-next v2 1/1] netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking gfree.wind
2017-04-13 21:57 ` Pablo Neira Ayuso
2017-04-13 23:04 ` Gao Feng [this message]
2017-04-13 23:11 ` Pablo Neira Ayuso
2017-04-14 4:52 ` Gao Feng
2017-04-19 15:57 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='001201d2b4aa$57bc8ba0$0735a2e0$@foxmail.com' \
--to=gfree.wind@foxmail.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.