netdev - Re: RAW netfilter - "advanced netfilter setting" or not?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 Nov 2011 22:27:46 +0100 (CET)
From:	Jan Engelhardt <jengelh@...ozas.de>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
cc:	David Miller <davem@...emloft.net>,
	Pablo Neira Ayuso <pablo@...filter.org>,
	Patrick McHardy <kaber@...sh.net>,
	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: RAW netfilter - "advanced netfilter setting" or not?

On Wednesday 2011-11-23 20:45, Linus Torvalds wrote:

>So I'm the one who long ago asked for some of the more esoteric
>netfilter configuration questions to be hidden behind some "advanced"
>question, and thus the reason why a lot of them are behind that
>NETFILTER_ADVANCED Kconfig setting.
>
>However, I'm now trying OpenSUSE on one of my laptops, and it looks
>like the RAW filter is used by the default OS iptables setup. The fact
>that it is hidden behind NETFILTER_ADVANCED now means that I either
>have to enable the advanced netfilter Kconfig questions, or we should
>just remove the "depends on NETFILTER_ADVANCED" for the RAW case (or,
>rather - caseS - since there's a separate raw filter for ipv4 and
>ipv6, which sounds odd in itself, but that's another issue entirely)

Welcome to the green. You will find the most complete Netfilter stack
here :)

>My gut feel is that if it's one of the filters that a major distro
>depends on by default, it should no longer be hidden. But honestly, I
>didn't look at *why* OpenSUSE uses that filter. Maybe it's just doing
>something really odd and crazy.

The "raw" table is populated by SUSE SFW2 with rules to exempt all
loopback packets from connection tracking since SFW2 at the same time
unconditionally allows all lo transfers in the "filter" table.

>Comments?

In my opinion, NETFILTER_ADVANCED should be changed to only control
the visibility of all suboptions, i.e. I suggest that "default m if
NETFILTER_ADVANCED=n" be done for all non-deprecated modules.
(Similar to how CONFIG_EXPERT works.)

Unless one wants to argue that "that's a detail left to the distro
makers" and "people not compiling kernels would never run into this
issue".
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html