netdev - Re: [PATCH 00/25] Conntracking and NAT in netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <485F73A4.8030108@trash.net>
Date:	Mon, 23 Jun 2008 11:57:56 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Alexey Dobriyan <adobriyan@...il.com>
CC:	netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
	den@...nvz.org, xemul@...nvz.org, ebiederm@...ssion.com,
	benjamin.thery@...l.net, dlezcano@...ibm.com
Subject: Re: [PATCH 00/25] Conntracking and NAT in netns

Alexey Dobriyan wrote:
> Hi, patchbomb below makes significant parts of connection tracking and
> NAT code usable in netns and independent from other netns.
> 
> Status is that it is lightly tested but more or less works, I used it on
> a box which provides NAT for another with all netdevices moved to netns,
> routing and iptables rules set up and rules flushed in init_net.

OK, I assume "Do not apply" applies to all patches then.

> So far so good.
> 
> Weak points:
> a) races during netns destruction or conntrack modules unload
>    (see more in patches)
> b) grabbing netns from skb->dev or skb->dst->dev
>    these places should be checked with extreme scrunity :-\

Will do.

> c) some stuff not converted (pptp, h323) -- it's like 10 minutes to make
>    a patch and full day to setup and test it :^)
> d) IPv6 conntracking wasn't tested.
 >
> e) ordering probably should be redone (or it shouldn't since netfilter
>    is banned in netns as is, so nobody will care)

I think its most important that its bisectable for the non-ns
case. So thats OK.



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html