{"action":"created","issue":{"url":"https://api.github.com/repos/betolj/ndpi-netfilter/issues/29","repository_url":"https://api.github.com/repos/betolj/ndpi-netfilter","labels_url":"https://api.github.com/repos/betolj/ndpi-netfilter/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/betolj/ndpi-netfilter/issues/29/comments","events_url":"https://api.github.com/repos/betolj/ndpi-netfilter/issues/29/events","html_url":"https://github.com/betolj/ndpi-netfilter/issues/29","id":163651846,"number":29,"title":"ndpi-netfilter kernel panics","user":{"login":"rightkick","id":15179132,"avatar_url":"https://avatars.githubusercontent.com/u/15179132?v=3","gravatar_id":"","url":"https://api.github.com/users/rightkick","html_url":"https://github.com/rightkick","followers_url":"https://api.github.com/users/rightkick/followers","following_url":"https://api.github.com/users/rightkick/following{/other_user}","gists_url":"https://api.github.com/users/rightkick/gists{/gist_id}","starred_url":"https://api.github.com/users/rightkick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rightkick/subscriptions","organizations_url":"https://api.github.com/users/rightkick/orgs","repos_url":"https://api.github.com/users/rightkick/repos","events_url":"https://api.github.com/users/rightkick/events{/privacy}","received_events_url":"https://api.github.com/users/rightkick/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-07-04T10:51:51Z","updated_at":"2016-07-05T18:29:56Z","closed_at":null,"body":"Hi. You mention that to compile netfilter-ndpi I need iptables-dev >= version 1.4.21-1ubuntu1.\r\n\r\nI have a Debian 7: \r\nkernel 3.18.36\r\niptables 1.4.14-3.1\r\niptables-dev 1.4.14-3.1\r\nconntrack 1:1.2.1-1+deb7u1 enabled (defaults from official debian repo).\r\n\r\nWhen compiled I managed to filter traffic etc but I've been getting some random kernel panics (reporting out of memory), especially when I put filtering rules at INCOMING and OUTGOING chains of the filter table. (kernel panics are more frequent when filtering rules are at INPUT, OUTGOING, FORWARD chains, while panics are less frequent when filtering only at FORWARD, indicating that the problem is exacerbated when more traffic is processed ).\r\n\r\nHave you tested with Debian 7? Going to iptables-dev >= 1.4.21 is the only option?\r\nThanx\r\n"},"comment":{"url":"https://api.github.com/repos/betolj/ndpi-netfilter/issues/comments/230562370","html_url":"https://github.com/betolj/ndpi-netfilter/issues/29#issuecomment-230562370","issue_url":"https://api.github.com/repos/betolj/ndpi-netfilter/issues/29","id":230562370,"user":{"login":"rightkick","id":15179132,"avatar_url":"https://avatars.githubusercontent.com/u/15179132?v=3","gravatar_id":"","url":"https://api.github.com/users/rightkick","html_url":"https://github.com/rightkick","followers_url":"https://api.github.com/users/rightkick/followers","following_url":"https://api.github.com/users/rightkick/following{/other_user}","gists_url":"https://api.github.com/users/rightkick/gists{/gist_id}","starred_url":"https://api.github.com/users/rightkick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rightkick/subscriptions","organizations_url":"https://api.github.com/users/rightkick/orgs","repos_url":"https://api.github.com/users/rightkick/repos","events_url":"https://api.github.com/users/rightkick/events{/privacy}","received_events_url":"https://api.github.com/users/rightkick/received_events","type":"User","site_admin":false},"created_at":"2016-07-05T18:29:56Z","updated_at":"2016-07-05T18:29:56Z","body":"Thanx @elico. I also had no issues during build on Debian7. It is only through testing that I observed issues. \r\n\r\nI have transferred now all ndpi filtering rules at mangle table, after loopback ACCEPT. I am suspecting that putting ndpi check rule before looback ACCEPT rules might be causing loops. \r\n\r\nBelow is the revised portin of firewall where ndpi rules reside, with few rules for accounting only:\r\n\r\n*mangle\r\n:PREROUTING ACCEPT [0:0]\r\n:INPUT ACCEPT [0:0]\r\n:FORWARD ACCEPT [0:0]\r\n:OUTPUT ACCEPT [0:0]\r\n:POSTROUTING ACCEPT [0:0]\r\n:ndpi-filter - [0:0]\r\n-A PREROUTING -s 127.0.0.0/16 -j ACCEPT\r\n-A PREROUTING -j ndpi-filter\r\n-A INPUT -s 127.0.0.0/16 -j ACCEPT\r\n-A FORWARD -s 127.0.0.0/16 -j ACCEPT\r\n-A FORWARD -j ndpi-filter\r\n-A OUTPUT -d 127.0.0.0/16 -j ACCEPT\r\n-A OUTPUT -j setel-mout-con\r\n-A POSTROUTING -d 127.0.0.0/16 -j ACCEPT\r\n-A POSTROUTING -j ndpi-filter\r\n-A ndpi-filter -m ndpi --dpi_check\r\n-A ndpi-filter -m ndpi --http\r\n-A ndpi-filter -m ndpi --facebook\r\n-A ndpi-filter -m ndpi --youtube\r\n-A ndpi-filter -m ndpi --dns\r\n-A ndpi-filter -m ndpi --skype\r\nCOMMIT\r\n\r\nIt is not clear to me what --dpi_check does. When printing with iptables -t mangle -nvL ndpi-filter it is showing as protocol CHECK with zero matching packets. Other traffic (e.g HTTP) is matched and counters are increasing, as below: \r\n\r\n    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           protocol CHECK\r\n19746   15M            all  --  *      *       0.0.0.0/0            0.0.0.0/0           protocol HTTP\r\n    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           protocol FACEBOOK\r\n    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           protocol YOUTUBE\r\n    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           protocol DNS\r\n    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0           protocol SKYPE\r\n\r\nany idea?\r\n"}}
{"actor":{"display_login":"rightkick"}}