netdev - Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for xt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a77a0537-4de1-1113-5492-7aee276c1f06@akamai.com>
Date:   Mon, 4 Sep 2017 21:56:33 -0400
From:   Vishwanath Pai <vpai@...mai.com>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     kadlec@...ckhole.kfki.hu, netfilter-devel@...r.kernel.org,
        johunt@...mai.com, fw@...len.de, netdev@...r.kernel.org,
        pai.vishwain@...il.com
Subject: Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for
 xt_hashlimit

On 09/04/2017 06:14 AM, Pablo Neira Ayuso wrote:
> Sounds good, applied, thanks.
> 
> A couple of questions: Does it really make sense to expose
> --hashlimit-rate-interval or are you using 1 second always there? I
> always wonder if it makes sense to expose yet another toggle that it's
> not clear to me how the user would take advantage from this.
> 
> Just curious here.

Thank you Pablo.

I generally just let rate-interval to default to 1, but I've added the
toggle to give the user more control on how often to sample the packet
rate. This wasn't an option before since we would always keep "delta" as
1 jiffy, but that is not the case in the new algorithm. Hence I have
exposed it as an option to the user.

Also, it looks like I broke the build on ARM and m68k arch. This is
because of the u64 division issue (sorry about that). I have sent
another patch to fix the problem "[PATCH] netfilter: xt_hashlimit: fix
64 bit division compile error". Please apply and send to net-next.

Thanks,
Vishwanath