Re: [PATCH] add new iptables ipt_connbytes match

2005-08-17 Thread Patrick McHardy
Amin Azez wrote: Work well done, so oughtn't div64_64 to go in include/asm-generic/div64.h one day, to be available kernel wide, as do_div64_64 I see that net/core/pktgen.c is full of 64 bit division and maybe could benefit from this, and perhaps a version that does remainders too. So far noth

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-16 Thread Amin Azez
Work well done, so oughtn't div64_64 to go in include/asm-generic/div64.h one day, to be available kernel wide, as do_div64_64 I see that net/core/pktgen.c is full of 64 bit division and maybe could benefit from this, and perhaps a version that does remainders too. Amin Patrick McHardy wrote: >

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-13 Thread David S. Miller
From: Harald Welte <[EMAIL PROTECTED]> Date: Sat, 13 Aug 2005 17:46:19 +0200 > [NETFILTER] Add new iptables "connbytes" match Applied. - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/m

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-13 Thread David S. Miller
From: Harald Welte <[EMAIL PROTECTED]> Date: Sat, 13 Aug 2005 16:50:23 +0200 > So for new development, I'm now more inclined to push things sooner to > you - even more for code that only adds new featurss. If you generally > dislike that, please let me know. I think this is the way to go. - To un

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-13 Thread David S. Miller
From: Harald Welte <[EMAIL PROTECTED]> Date: Sat, 13 Aug 2005 16:51:57 +0200 > Ok, just in case Dave was waiting for my comments (which are usually > not required since Patricks patches tend to have a higher quality than > mine): > > ACK-ed-by: Harald Welte <[EMAIL PROTECTED]> I like to see ACK

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-13 Thread David S. Miller
From: Patrick McHardy <[EMAIL PROTECTED]> Subject: Re: [PATCH] add new iptables ipt_connbytes match Date: Sat, 13 Aug 2005 03:20:06 +0200 > Harald Welte wrote: > > Just send two incremental patches to Dave. > > Here they are. The first patch fixes the div64_64 function, the

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-13 Thread Harald Welte
The reworked version (already uses aligned_u64). Pleas apply, thanks -- - Harald Welte <[EMAIL PROTECTED]> http://netfilter.org/ "Fragmentation is like classful addressing -- an interesting early ar

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-13 Thread Harald Welte
On Fri, Aug 12, 2005 at 12:09:04PM -0700, David S. Miller wrote: > From: Harald Welte <[EMAIL PROTECTED]> > Date: Fri, 12 Aug 2005 21:03:43 +0200 > > > Ok, I hope everyone is fine with this patch: > > It is, but I did not add the connbytes patch into my tree so I can't > use this patch as-is. Th

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-13 Thread Harald Welte
On Sat, Aug 13, 2005 at 03:20:06AM +0200, Patrick McHardy wrote: > Harald Welte wrote: > >Just send two incremental patches to Dave. > > Here they are. The first patch fixes the div64_64 function, the second > one renames some constants. Ok, just in case Dave was waiting for my comments (which a

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Patrick McHardy
Harald Welte wrote: Just send two incremental patches to Dave. Here they are. The first patch fixes the div64_64 function, the second one renames some constants. [NETFILTER]: Fix div64_64 in ipt_connbytes Signded-off-by: Patrick McHardy <[EMAIL PROTECTED]> --- commit 62084bc1a04e2fbc492566fa

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Andi Kleen
Looks good. Thanks, -Andi - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread David S. Miller
From: Harald Welte <[EMAIL PROTECTED]> Date: Fri, 12 Aug 2005 21:03:43 +0200 > Ok, I hope everyone is fine with this patch: It is, but I did not add the connbytes patch into my tree so I can't use this patch as-is. That's why I replied "this is broken, fix u64 alignment" to the connbytes patch i

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Harald Welte
On Fri, Aug 12, 2005 at 08:23:55PM +0200, Andi Kleen wrote: > > I don't think that we're ever going to fix that bug in the old > > {get,set}sockopt interface, but rather introduce a netlink interface > > when pkt_tables matures. > > All new interfaces should be emulation clean, so that if the old

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Andi Kleen
> I don't think that we're ever going to fix that bug in the old > {get,set}sockopt interface, but rather introduce a netlink interface > when pkt_tables matures. All new interfaces should be emulation clean, so that if the old interface is replaced later it should eventually work. The best way to

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread David S. Miller
From: Harald Welte <[EMAIL PROTECTED]> Date: Fri, 12 Aug 2005 17:37:30 +0200 > But getting back to the original connbytes issue. Is it worth fixing > it, if the core iptables doesn't even work (the "old bug")? I think it is a good policy to not let in new code, regardless of context, which uses

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Harald Welte
On Fri, Aug 12, 2005 at 02:03:20PM +0200, Andi Kleen wrote: > > Unfortunately one of the iptables structures which is needed to get the > > ruleset in the kernel (ipt_replace) is differently sized when compiled > > for 32/64 bit. IIRC it doesn't work at all currently. > > Yes that's the old bug an

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Harald Welte
On Fri, Aug 12, 2005 at 04:52:49AM +0200, Patrick McHardy wrote: > This functions looks broken. I feared it... > Divisor and divident are mixed up, the > shifted result variable is not used in the actual division, the > "first bit has to be < 32" assumption is wrong and num_shift is > calculate

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Harald Welte
On Thu, Aug 11, 2005 at 03:42:04PM -0700, David S. Miller wrote: > From: Harald Welte <[EMAIL PROTECTED]> > Date: Thu, 11 Aug 2005 22:03:49 +0200 > > > +struct ipt_connbytes_info > > +{ > > + struct { > > + u_int64_t from; /* count to be matched */ > > + u_int64_t to; /* co

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Andi Kleen
> Unfortunately one of the iptables structures which is needed to get the > ruleset in the kernel (ipt_replace) is differently sized when compiled > for 32/64 bit. IIRC it doesn't work at all currently. Yes that's the old bug and cannot be fixed without breaking compatibility. But we hope that c

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Patrick McHardy
Andi Kleen wrote: > "David S. Miller" <[EMAIL PROTECTED]> writes: >> >>Won't work in x86 --> x86_64 compat environments. > > Thanks for catching it. > > The aligned u64 trick probably will > > #define aligned_u64 unsigned long long __attribute__((aligned(8))) > > It just forces i386 to be align

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-12 Thread Andi Kleen
"David S. Miller" <[EMAIL PROTECTED]> writes: > From: Harald Welte <[EMAIL PROTECTED]> > Date: Thu, 11 Aug 2005 22:03:49 +0200 > > > +struct ipt_connbytes_info > > +{ > > + struct { > > + u_int64_t from; /* count to be matched */ > > + u_int64_t to; /* count to be matched

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-11 Thread Patrick McHardy
Harald Welte wrote: +/* 64bit divisor, dividend and result. dynamic precision */ +static u_int64_t div64_64(u_int64_t divisor, u_int64_t dividend) +{ + u_int64_t result = divisor; + + if (dividend > 0x) { + int first_bit = find_first_bit((unsigned long *) ÷nd, s

Re: [PATCH] add new iptables ipt_connbytes match

2005-08-11 Thread David S. Miller
From: Harald Welte <[EMAIL PROTECTED]> Date: Thu, 11 Aug 2005 22:03:49 +0200 > +struct ipt_connbytes_info > +{ > + struct { > + u_int64_t from; /* count to be matched */ > + u_int64_t to; /* count to be matched */ > + } count; > + u_int8_t what; /* ip

[PATCH] add new iptables ipt_connbytes match

2005-08-11 Thread Harald Welte
Hi Dave, please apply to your net-2.6.14 tree: -- - Harald Welte <[EMAIL PROTECTED]> http://netfilter.org/ "Fragmentation is like classful addressing -- an interesting early architectural error that