Subject: Re: [resend] Passive OS fingerprint xtables match.

From: Patrick McHardy <[email-masked]>
Date: Thu, 04 Jun 2009 13:53:05 +0200

Evgeniy Polyakov wrote:
> Hi.
> 
> On Wed, May 27, 2009 at 06:28:16PM +0200, Patrick McHardy ([email-masked]) wrote:
>>> You will find something like this in the syslog:
>>> Windows [2000:SP3:Windows XP Pro SP1, 2000 SP3]: 11.22.33.55:4024 -> 
>>> 11.22.33.44:139 hops=4
>>> Linux [2.5:]: 1.2.3.4:44448 -> 11.22.33.44:22 hops=4
>> Please convert this to use nf_log_packet().
> 
> That's hard - there is no hook number in the match function, so we do
> not really know if it is forward, input or prerouting.

This is really needed, spamming the ring buffer is not a good option.

I'd say just add the hook number to xt_match_param. Its a bit
inconsistent anyways that we're handing it to checkentry for
validation, but not to the match function.