[{"id":1762555,"web_url":"http://patchwork.ozlabs.org/comment/1762555/","msgid":"<20170904101433.GA3979@salvia>","list_archive_url":null,"date":"2017-09-04T10:14:33","subject":"Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for\n\txt_hashlimit","submitter":{"id":1315,"url":"http://patchwork.ozlabs.org/api/people/1315/","name":"Pablo Neira Ayuso","email":"pablo@netfilter.org"},"content":"On Fri, Aug 18, 2017 at 04:58:59PM -0400, Vishwanath Pai wrote:\n[...]\n> The main difference between the existing algorithm and the new one is\n> that the existing algorithm rate-limits the flow whereas the new\n> algorithm does not. Instead it *classifies* the flow based on whether\n> it is above or below a certain rate. I will demonstrate this with an\n> example below. Let us assume this rule:\n> \n> iptables -A INPUT -m hashlimit --hashlimit-above 10/s -j new_chain\n> \n> If the packet rate is 15/s, the existing algorithm would ACCEPT 10\n> packets every second and send 5 packets to \"new_chain\".\n> \n> But with the new algorithm, as long as the rate of 15/s is sustained,\n> all packets will continue to match and every packet is sent to new_chain.\n\nSounds good, applied, thanks.\n\nA couple of questions: Does it really make sense to expose\n--hashlimit-rate-interval or are you using 1 second always there? I\nalways wonder if it makes sense to expose yet another toggle that it's\nnot clear to me how the user would take advantage from this.\n\nJust curious here.\n--\nTo unsubscribe from this list: send the line \"unsubscribe netfilter-devel\" in\nthe body of a message to majordomo@vger.kernel.org\nMore majordomo info at http://vger.kernel.org/majordomo-info.html","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netfilter-devel-owner@vger.kernel.org;\n\treceiver=)","Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xm5M219tFz9s7m\n\tfor ;\n\tMon, 4 Sep 2017 20:15:10 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1753430AbdIDKPF (ORCPT );\n\tMon, 4 Sep 2017 06:15:05 -0400","from ganesha.gnumonks.org ([213.95.27.120]:45308 \"EHLO\n\tganesha.gnumonks.org\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1753350AbdIDKPE (ORCPT\n\t);\n\tMon, 4 Sep 2017 06:15:04 -0400","from 129.166.216.87.static.jazztel.es ([87.216.166.129]\n\thelo=gnumonks.org) by ganesha.gnumonks.org with esmtpsa\n\t(TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2)\n\t(envelope-from )\n\tid 1dooOp-000849-6Z; Mon, 04 Sep 2017 12:14:41 +0200"],"Date":"Mon, 4 Sep 2017 12:14:33 +0200","From":"Pablo Neira Ayuso ","To":"Vishwanath Pai ","Cc":"kadlec@blackhole.kfki.hu, netfilter-devel@vger.kernel.org,\n\tjohunt@akamai.com, fw@strlen.de, netdev@vger.kernel.org,\n\tpai.vishwain@gmail.com","Subject":"Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for\n\txt_hashlimit","Message-ID":"<20170904101433.GA3979@salvia>","References":"<1503089939-15938-1-git-send-email-vpai@akamai.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<1503089939-15938-1-git-send-email-vpai@akamai.com>","User-Agent":"Mutt/1.5.23 (2014-03-12)","X-Spam-Score":"-2.9 (--)","Sender":"netfilter-devel-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netfilter-devel@vger.kernel.org"}},{"id":1762588,"web_url":"http://patchwork.ozlabs.org/comment/1762588/","msgid":"<20170904113128.GA3757@salvia>","list_archive_url":null,"date":"2017-09-04T11:31:28","subject":"Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for\n\txt_hashlimit","submitter":{"id":1315,"url":"http://patchwork.ozlabs.org/api/people/1315/","name":"Pablo Neira Ayuso","email":"pablo@netfilter.org"},"content":"On Mon, Sep 04, 2017 at 12:14:33PM +0200, Pablo Neira Ayuso wrote:\n> On Fri, Aug 18, 2017 at 04:58:59PM -0400, Vishwanath Pai wrote:\n> [...]\n> > The main difference between the existing algorithm and the new one is\n> > that the existing algorithm rate-limits the flow whereas the new\n> > algorithm does not. Instead it *classifies* the flow based on whether\n> > it is above or below a certain rate. I will demonstrate this with an\n> > example below. Let us assume this rule:\n> > \n> > iptables -A INPUT -m hashlimit --hashlimit-above 10/s -j new_chain\n> > \n> > If the packet rate is 15/s, the existing algorithm would ACCEPT 10\n> > packets every second and send 5 packets to \"new_chain\".\n> > \n> > But with the new algorithm, as long as the rate of 15/s is sustained,\n> > all packets will continue to match and every packet is sent to new_chain.\n> \n> Sounds good, applied, thanks.\n\nBTW, for the record, I have rename this patch title to:\n\nnetfilter: xt_hashlimit: add rate match mode\n\n--\nTo unsubscribe from this list: send the line \"unsubscribe netfilter-devel\" in\nthe body of a message to majordomo@vger.kernel.org\nMore majordomo info at http://vger.kernel.org/majordomo-info.html","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netfilter-devel-owner@vger.kernel.org;\n\treceiver=)","Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xm73m1s5Vz9s8J\n\tfor ;\n\tMon, 4 Sep 2017 21:32:04 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1753486AbdIDLb5 (ORCPT );\n\tMon, 4 Sep 2017 07:31:57 -0400","from ganesha.gnumonks.org ([213.95.27.120]:45935 \"EHLO\n\tganesha.gnumonks.org\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1753443AbdIDLb5 (ORCPT\n\t);\n\tMon, 4 Sep 2017 07:31:57 -0400","from 129.166.216.87.static.jazztel.es ([87.216.166.129]\n\thelo=gnumonks.org) by ganesha.gnumonks.org with esmtpsa\n\t(TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2)\n\t(envelope-from )\n\tid 1dopbF-0003Qu-IP; Mon, 04 Sep 2017 13:31:35 +0200"],"Date":"Mon, 4 Sep 2017 13:31:28 +0200","From":"Pablo Neira Ayuso ","To":"Vishwanath Pai ","Cc":"kadlec@blackhole.kfki.hu, netfilter-devel@vger.kernel.org,\n\tjohunt@akamai.com, fw@strlen.de, netdev@vger.kernel.org,\n\tpai.vishwain@gmail.com","Subject":"Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for\n\txt_hashlimit","Message-ID":"<20170904113128.GA3757@salvia>","References":"<1503089939-15938-1-git-send-email-vpai@akamai.com>\n\t<20170904101433.GA3979@salvia>","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<20170904101433.GA3979@salvia>","User-Agent":"Mutt/1.5.23 (2014-03-12)","X-Spam-Score":"-2.9 (--)","Sender":"netfilter-devel-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netfilter-devel@vger.kernel.org"}},{"id":1762908,"web_url":"http://patchwork.ozlabs.org/comment/1762908/","msgid":"","list_archive_url":null,"date":"2017-09-05T01:56:33","subject":"Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for\n\txt_hashlimit","submitter":{"id":66296,"url":"http://patchwork.ozlabs.org/api/people/66296/","name":"Vishwanath Pai","email":"vpai@akamai.com"},"content":"On 09/04/2017 06:14 AM, Pablo Neira Ayuso wrote:\n> Sounds good, applied, thanks.\n> \n> A couple of questions: Does it really make sense to expose\n> --hashlimit-rate-interval or are you using 1 second always there? I\n> always wonder if it makes sense to expose yet another toggle that it's\n> not clear to me how the user would take advantage from this.\n> \n> Just curious here.\n\n\nThank you Pablo.\n\nI generally just let rate-interval to default to 1, but I've added the\ntoggle to give the user more control on how often to sample the packet\nrate. This wasn't an option before since we would always keep \"delta\" as\n1 jiffy, but that is not the case in the new algorithm. Hence I have\nexposed it as an option to the user.\n\nAlso, it looks like I broke the build on ARM and m68k arch. This is\nbecause of the u64 division issue (sorry about that). I have sent\nanother patch to fix the problem \"[PATCH] netfilter: xt_hashlimit: fix\n64 bit division compile error\". Please apply and send to net-next.\n\nThanks,\nVishwanath\n--\nTo unsubscribe from this list: send the line \"unsubscribe netfilter-devel\" in\nthe body of a message to majordomo@vger.kernel.org\nMore majordomo info at http://vger.kernel.org/majordomo-info.html","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netfilter-devel-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tsecure) header.d=akamai.com header.i=@akamai.com header.b=\"HetxAZeP\";\n\tdkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xmVFm3RHHz9sP3\n\tfor ;\n\tTue, 5 Sep 2017 11:57:00 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1754089AbdIEB44 (ORCPT );\n\tMon, 4 Sep 2017 21:56:56 -0400","from mx0b-00190b01.pphosted.com ([67.231.157.127]:45244 \"EHLO\n\tmx0b-00190b01.pphosted.com\" rhost-flags-OK-OK-OK-OK)\n\tby vger.kernel.org with ESMTP id S1754070AbdIEB4z (ORCPT\n\t);\n\tMon, 4 Sep 2017 21:56:55 -0400","from pps.filterd (m0050096.ppops.net [127.0.0.1])\n\tby m0050096.ppops.net-00190b01. (8.16.0.21/8.16.0.21) with SMTP id\n\tv851qYRp022429; Tue, 5 Sep 2017 02:56:35 +0100","from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com\n\t[184.51.33.18])\n\tby m0050096.ppops.net-00190b01. with ESMTP id 2cqn26mvpy-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256\n\tverify=NOT); Tue, 05 Sep 2017 02:56:35 +0100","from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1])\n\tby prod-mail-ppoint1.akamai.com (8.16.0.17/8.16.0.17) with SMTP id\n\tv851uXSm004299; Mon, 4 Sep 2017 21:56:34 -0400","from prod-mail-relay10.akamai.com ([172.27.118.251])\n\tby prod-mail-ppoint1.akamai.com with ESMTP id 2cqqyu4217-1;\n\tMon, 04 Sep 2017 21:56:34 -0400","from [172.28.13.81] (bos-lpqrs.kendall.corp.akamai.com\n\t[172.28.13.81])\n\tby prod-mail-relay10.akamai.com (Postfix) with ESMTP id 2E8281FC86;\n\tTue, 5 Sep 2017 01:56:33 +0000 (GMT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com;\n\th=subject : to : cc :\n\treferences : from : message-id : date : mime-version : in-reply-to :\n\tcontent-type : content-transfer-encoding; s=jan2016.eng;\n\tbh=aTS1gnQX5QVZqm9GfkJxiPTs7aFm6vLAVADacmsZ/tQ=;\n\tb=HetxAZePisQXMmB1ecfxg5OX8mlEUeiK9fXzWjW7UiVOq2mbiEFyRzLCTtA50ZzIGNbi\n\tmnSpmrVm3vQN2A8QkopNLKp0K/69Ag8B5xwdD7bD0l+AuwCFalcjO07UmG8Ip2O43rdP\n\tXCQNtp+Rl66uNd8W0uTX1AFRgZLU6peuvoQRH5VOcc6Zd5ZwZB0bMnCPZABPvPBOnyqu\n\tE95WSCs7cevU5j+fIV1Cu0Ht+j7fu+7vBbWRZXlVOMOlol+mBs8ec3VoGf0L9wR0NBdI\n\t73u1AF07hfQsXNzr4vT8RCPcPWM/Uqv7xM2qB7+N7lO5+wu92MEQa6NtSeoth7dmNsC1\n\tpA== ","Subject":"Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for\n\txt_hashlimit","To":"Pablo Neira Ayuso ","Cc":"kadlec@blackhole.kfki.hu, netfilter-devel@vger.kernel.org,\n\tjohunt@akamai.com, fw@strlen.de, netdev@vger.kernel.org,\n\tpai.vishwain@gmail.com","References":"<1503089939-15938-1-git-send-email-vpai@akamai.com>\n\t<20170904101433.GA3979@salvia>","From":"Vishwanath Pai ","Message-ID":"","Date":"Mon, 4 Sep 2017 21:56:33 -0400","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101\n\tThunderbird/52.1.1","MIME-Version":"1.0","In-Reply-To":"<20170904101433.GA3979@salvia>","Content-Type":"text/plain; charset=utf-8","Content-Language":"en-US","Content-Transfer-Encoding":"7bit","X-Proofpoint-Virus-Version":["vendor=fsecure engine=2.50.10432:, ,\n\tdefinitions=2017-09-04_14:, , signatures=0","vendor=fsecure engine=2.50.10432:, ,\n\tdefinitions=2017-09-04_14:, , signatures=0"],"X-Proofpoint-Spam-Details":["rule=notspam policy=default score=0 spamscore=0\n\tsuspectscore=0\n\tmalwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam\n\tadjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000\n\tdefinitions=main-1709050028","rule=notspam policy=default score=0\n\tpriorityscore=1501 malwarescore=0\n\tsuspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015\n\tlowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam\n\tadjust=0\n\treason=mlx scancount=1 engine=8.0.1-1707230000\n\tdefinitions=main-1709050027"],"Sender":"netfilter-devel-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netfilter-devel@vger.kernel.org"}}]