netdev - Re: iproute2 action/policer question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090615145222.GA2767@ami.dom.local>
Date:	Mon, 15 Jun 2009 16:52:22 +0200
From:	Jarek Poplawski <jarkao2@...il.com>
To:	jamal <hadi@...erus.ca>
Cc:	Paweł Staszewski <pstaszewski@...are.pl>,
	Linux Network Development list <netdev@...r.kernel.org>
Subject: Re: iproute2 action/policer question

On Mon, Jun 15, 2009 at 09:32:08AM -0400, jamal wrote:
> On Mon, 2009-06-15 at 11:19 +0000, Jarek Poplawski wrote:
> 
> > > This is only a sample but is not working
> 
> It does seem to be working!
> How did you reach conclusion it wasnt working?
> 
> > >         Action statistics:
> > >         Sent 42351 bytes 110 pkt (dropped 0, overlimits 32 requeues 0)
> > >         rate 0bit 0pps backlog 0b 0p requeues 0
> 
> 32 packets hit the policer - double check your parameters please to make
> sure they are correct.

Actually, I wonder if these "dropped 0" are OK here if we expect
dropping.

> 
> > According to iproute2/doc/actions/actions_general mangle targets
> > should work; and you could also try (if it doesn't work then probably
> > it can't be used...;-)
> 
> They should all be usable. If something crashes, there is a bug
> somewhere.
> 
> > But... I'm neither able to configure/compile it with the current
> > iproute2/iptables, nor test it with distro's builds (Debian testing).
> > After some checking I found iproute2 needs updating, because iptables
> > changes API (xtables.h) virtually with every new version, so I don't
> > even blame the ipt author or distro maintainer.
> > 
> 
> We are hopefully getting stable there. Anything on debian lenny
> should be working with iptables 1.4.3; i expect at most "one last
> change" (famous last words) to break backward compat as iptables 
> moves from version 1.4.3.

I've tried debian squeeze (testing) with: iptables v1.4.3.2, iproute2
-ss090324, and action ipt -j MARK doesn't work. AFAIK debian lenny
(stable) uses 1.4.2. I've also tried debian rescue probably based on
lenny (with iptables 1.4.2), and it seemed it didn't work yet (I'll
re-check this). When you have something new I'd be glad for Cc.

Thanks more than always Jamal,
Jarek P.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html