netdev - RAW netfilter - "advanced netfilter setting" or not?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFxtSgLppJQ8EbQEovdXsCNxQ1gT31FyP2cpyuvoBLajZw@mail.gmail.com>
Date:	Wed, 23 Nov 2011 11:45:02 -0800
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	David Miller <davem@...emloft.net>,
	Pablo Neira Ayuso <pablo@...filter.org>,
	Patrick McHardy <kaber@...sh.net>
Cc:	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: RAW netfilter - "advanced netfilter setting" or not?

So I'm the one who long ago asked for some of the more esoteric
netfilter configuration questions to be hidden behind some "advanced"
question, and thus the reason why a lot of them are behind that
NETFILTER_ADVANCED Kconfig setting.

However, I'm now trying OpenSUSE on one of my laptops, and it looks
like the RAW filter is used by the default OS iptables setup. The fact
that it is hidden behind NETFILTER_ADVANCED now means that I either
have to enable the advanced netfilter Kconfig questions, or we should
just remove the "depends on NETFILTER_ADVANCED" for the RAW case (or,
rather - caseS - since there's a separate raw filter for ipv4 and
ipv6, which sounds odd in itself, but that's another issue entirely)

My gut feel is that if it's one of the filters that a major distro
depends on by default, it should no longer be hidden. But honestly, I
didn't look at *why* OpenSUSE uses that filter. Maybe it's just doing
something really odd and crazy.

Comments?

                           Linus
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html