netdev - Re: [PATCH RFC 0/4] net: add bpfilter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180220130549.GA4196@orbyte.nwl.cc>
Date:   Tue, 20 Feb 2018 14:05:49 +0100
From:   Phil Sutter <phil@....cc>
To:     David Miller <davem@...emloft.net>
Cc:     laforge@...monks.org, fw@...len.de, daniel@...earbox.net,
        netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
        alexei.starovoitov@...il.com
Subject: Re: [PATCH RFC 0/4] net: add bpfilter

Hi David,

On Mon, Feb 19, 2018 at 12:15:37PM -0500, David Miller wrote:
> From: Phil Sutter <phil@....cc>
> Date: Mon, 19 Feb 2018 18:09:39 +0100
> 
> > What puzzles me about your argumentation is that you seem to propose for
> > the kernel to cover up flaws in userspace. Spinning this concept further
> > would mean that if there would be an old bug in iproute2 we should think
> > of adding a workaround to rtnetlink interface in kernel because
> > containers will keep the old iproute2 binary? Or am I (hopefully) just
> > missing your point?
> 
> I'll answer this with a question.  I tried to remove UFO entirely from
> the kernel, did you see how that went?

:)

I didn't follow back then, but found mails about KVM live migration
breakage when moving to a kernel without UFO. But isn't that a problem
with how virtio_net optimizes things? Florian recently told me how
iptables CHECKSUM target was mainly introduced to overcome a different
problem in the same area. So all this is kernel covering up for kernel
problems. My question was about covering up for userspace bugs in
kernelspace. If you think that is preferable over fixing userspace, I
have to put that in consideration when dealing with userspace issues.

Cheers, Phil