lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Thu, 03 Feb 2011 17:01:27 +0100
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Hans Schillstrom <hans.schillstrom@...csson.com>
CC:	"kaber@...sh.net" <kaber@...sh.net>,
	"jengelh@...ozas.de" <jengelh@...ozas.de>,
	"netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"hans@...illstrom.com" <hans@...illstrom.com>
Subject: Re: [PATCH] NETFILTER module xt_hmark new target for HASH MARK

On 03/02/11 16:42, Pablo Neira Ayuso wrote:
> On 03/02/11 15:23, Hans Schillstrom wrote:
>> On Thu, 2011-02-03 at 14:51 +0100, Pablo Neira Ayuso wrote:
>>> On 03/02/11 14:34, Hans Schillstrom wrote:
>>> this assumption is not valid in NAT handlings.
>>
>> That's true, because I want to avoid conntrack
>>
>>> If you want consistent hashing with NAT handlings you'll have to make
>>> this stateful and use the conntrack source and reply directions of the
>>> original tuples (thus making it stateful). That may be a problem because
>>> some people may want to use this without enabling connection tracking.
>>
>> What about a compilation switch or a sysctl ?
> 
> or better some option for iptables.

Hm, this is actually not straight forward to implement, you'll have to
use hook functions to avoid the module dependencies with conntrack and
that's pretty annoying.

I don't come up with a good solution for this.

>>> Are you using this for (uplink) load balancing?
>>
>> Actually in both ways 
>>  - in front of a bunch of ipvs

to make some preliminary load-sharing between the load balancers?

>>  - and in the payloads for outgoing traffic.

and then to select the uplink, right?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists