netdev - Re: [PATCH 2/4] netfilter: default CONFIG_NETFILTER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150529094423.GA3347@salvia>
Date:	Fri, 29 May 2015 11:44:23 +0200
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Jan Engelhardt <jengelh@...i.de>
Cc:	netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org
Subject: Re: [PATCH 2/4] netfilter: default CONFIG_NETFILTER_INGRESS to y

On Fri, May 29, 2015 at 08:19:35AM +0200, Jan Engelhardt wrote:
> On Friday 2015-05-29 01:44, Pablo Neira Ayuso wrote:
> 
> >Useful to compile-test all options.
> >
> >--- a/net/netfilter/Kconfig
> >+++ b/net/netfilter/Kconfig
> >@@ -3,6 +3,7 @@ menu "Core Netfilter Configuration"
> > 
> > config NETFILTER_INGRESS
> > 	bool "Netfilter ingress support"
> >+	default y
> > 	select NET_INGRESS
> > 	help
> > 	  This allows you to classify packets from ingress using the Netfilter
> 
> Careful with default y. I seem to remember that someone higher up
> (perhaps Linus himself) was against "default y" for features deemed
> not essential (especially hardware drivers), as no driver is any
> more important than another. If "compile-test" is your reason for the
> patch, it might fall into the same category.

This config option is hiding behind the global CONFIG_NETFILTER switch
that, if enabled, gets the very basic hook infrastructure, and this
ingress hook falls into that category.

I agree this makes sense for hardware drivers, but this is not the
case.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html