Re: [PATCH v6] Netfilter ring buffer support
On 08.03.2012 02:28, Pablo Neira Ayuso wrote:
On Tue, Mar 06, 2012 at 12:19:42AM +0100, Richard Weinberger wrote:This patch set merges ipt_LOG and ip6t_LOG and adds ring buffer support to xt_LOG. Using "--ring" an user can create LOG rules which log messages into one or more ring buffers. Each ring buffer is represented as pipe-like file in /proc/net/netfilter/nf_log_ring/.I've spent part of the evening testing this and checking its possibilities, the drawbacks that I see for this contribution are: * it uses the /proc entry, we have rejected similar add-ons in the past that have used these interfaces.
My fist implementation used sysfs/debug. I've switched to /proc/net/netfilter/ to make it consistent to the other netfilter stuff... Moving back to sysfs/debug/whatever can be done within minutes.
* one single reader can be reading at a time.
In which use-cache you need two _consuming_ readers? Steve's ring_buffer supports also concurrent non-consuming reads. I can add support for this...
Having said that, I still think that the feature that this provides is useful, but I think that implementing this in user-space over nfnetlink_log results in a much more flexible solution. I have made proof-of-concept daemon (it's a quick hack of several hours) that implements the similar feature over nfnetlink_log, advantages are: * You don't need to upgrade your kernel / iptables. * You only need to install libnfnetlink, libnetfilter_log and the daemon. * It can be extended to support multiple readers. So my conclusion is that you can make this in userspace in a much more flexible way. You can find it here: http://1984.lsi.us.es/git/rlogd/ The initial commit provides some description on how to use it: http://1984.lsi.us.es/git/rlogd/commit/?id=ccb88a8dc8ad674b860f2d3edabf07fe4830baf3 I don't plan to develop / maintain that software. The last thing I want in my todo list is yet another thing to maintain. If someone is interested, please, feel free to grab it, make a nice website for it and maintain it. The repository also contains an unfinished patch to add LOG format support to libnetfilter_log.
I really don't like this rlogd thing. 1. It's yet another random netfilter userspace component. Please don't fragment it more.Installing iptables/conntrack/ulogd/etc... is already enough PITA because not all distros ship all this clustered components.
2. As I described in my very fist RLOG patch, NFLOG does not include the same information.
You cannot derive "PHYSIN" and "PHYSOUT" from the packet header. 3. rlogd needs NFLOG which copies every packet (header) to userspace. What about performance...? Thanks, //richard -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
[Linux Kernel Discussion] [Ethernet Bridging] [Linux Wireless Networking] [Linux Bluetooth Networking] [Linux Networking Users] [VLAN] [Git] [IETF Annouce] [Linux Assembly] [Security] [Bugtraq] [Photo] [Singles Social Networking] [Yosemite Information] [MIPS Linux] [ARM Linux Kernel] [ARM Linux] [Linux Virtualization] [Linux Security] [Linux IDE] [Linux RAID] [Linux SCSI] [Free Dating]