Message-ID: <20030824152052.57555.qmail@web40505.mail.yahoo.com>
Date: Sun, 24 Aug 2003 08:20:52 -0700 (PDT)
From: Alex Davis <alex14641@yahoo.com>
Subject: Re: [RFC] patch for invalid packet time from ULOG target of iptables
To: Harald Welte <laforge@gnumonks.org>
Cc: linux-kernel@vger.kernel.org, ulogd@lists.gnumonks.org,
       Netfilter Development Mailinglist 
	<netfilter-devel@lists.netfilter.org>
In-Reply-To: <20030824150024.GF10987@sunbeam.de.gnumonks.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2129
Lines: 58

I understand. Thanks.

-Alex


--- Harald Welte <laforge@gnumonks.org> wrote:
> On Sun, Aug 24, 2003 at 07:16:00AM -0700, Alex Davis wrote:
> > I've just started playing with the ULOG target in
> > iptables, and I've noticed that the 'timestamp_sec'
> > member of the ulog_packet_msg_t struct paseed to
> > the user is always 0 for locally generated packets.
> 
> This is a well-known behaviour (see the list archives of
> netfilter-devel@lists.netfilter.org or ulogd@lists.gnumonks.org).
> 
> This is _NOT_ considered a bug, but a feature.
> 
> > I was thinking of patching the ipt_ulog_target
> > function in net/ipv4/netfilter/ipt_ULOG.c to
> > check if timestamp_sec is 0 and if so, set it
> > to the current time by adding code to test
> > 'timestamp_sec' after it's been set. E.g;
> 
> so how would you then differentiate in userspace between 
> 
> a) a skb receive timestamp
> b) a timestamp created within the ULOG target (which can be very
>    different, think of async packets via QUEUE, etc.)
> 
> We definitely don't want to have one field in the packet that has
> different semantics according from which hook it came in.
> 
> What ulogd currently does, is _always_ logging the userspace time,
> disregarding the skb receive timestamp.  This is way closer to the LOG
> target behaviuor anyway, since in this case the time is prepended by
> syslogd (which just calls gettimeofday() from userspace).
> 
> -- 
> - Harald Welte <laforge@gnumonks.org>               http://www.gnumonks.org/
> ============================================================================
> Programming is like sex: One mistake and you have to support it your lifetime
> 

> ATTACHMENT part 2 application/pgp-signature 


=====
I code, therefore I am

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/