netdev - Re: [PATCH 2/3] x_tables: Use also dev->ifalias for interface matching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <54B3F265.9030301@nod.at>
Date:	Mon, 12 Jan 2015 17:12:21 +0100
From:	Richard Weinberger <richard@....at>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	davem@...emloft.net, coreteam@...filter.org,
	netfilter-devel@...r.kernel.org, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org, bhutchings@...arflare.com,
	john.fastabend@...il.com, herbert@...dor.apana.org.au,
	vyasevic@...hat.com, jiri@...nulli.us, vfalico@...il.com,
	therbert@...gle.com, edumazet@...gle.com, yoshfuji@...ux-ipv6.org,
	jmorris@...ei.org, kuznet@....inr.ac.ru, kadlec@...ckhole.kfki.hu,
	kaber@...sh.net, pablo@...filter.org, kay@...y.org,
	stephen@...workplumber.org
Subject: Re: [PATCH 2/3] x_tables: Use also dev->ifalias for interface matching

Am 12.01.2015 um 17:04 schrieb Eric Dumazet:
> On Sun, 2015-01-11 at 21:52 +0100, Richard Weinberger wrote:
>> Signed-off-by: Richard Weinberger <richard@....at>
>> ---
>>  include/linux/netfilter/x_tables.h | 22 ++++++++++++++++++++++
>>  net/ipv4/netfilter/arp_tables.c    | 28 +++++++++++++++++-----------
>>  net/ipv4/netfilter/ip_tables.c     | 15 +++++----------
>>  net/ipv6/netfilter/ip6_tables.c    | 18 +++++++-----------
>>  net/netfilter/xt_physdev.c         |  9 ++-------
>>  5 files changed, 53 insertions(+), 39 deletions(-)
> 
> Richard, I dislike this, sorry.

That's fine, the series carries the "RFC" burning mark for a reason.

> iptables is already horribly expensive, you add another expensive step
> for every rule.

Yeah, you mean the extra unlikey() check?

> device aliasing can be done from user space.

How?

I did this series because I'm not so happy with the device renaming what udev
does.
The idea was to offer udev a better kernel interface to deal with aliases.
Such that one can use the regular names form the kernel and the predictable
names generated from udev.

For block devices it was easy, we have the good old symlink.
For network interface the kernel does not offer an API.

> iptables should have used ifindex, its sad we allowed the substring
> match in first place.

Maybe nftables can do better. :-)

Thanks,
//richard
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html