netdev - Re: [PATCH iproute2-next] Introduce ip-brctl shell script

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 25 Jan 2019 11:04:37 +0100
From:   Stefano Brivio <sbrivio@...hat.com>
To:     Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
Cc:     David Ahern <dsahern@...il.com>, Phil Sutter <phil@....cc>,
        Eric Garver <egarver@...hat.com>,
        Tomas Dolezal <todoleza@...hat.com>,
        Stephen Hemminger <stephen@...workplumber.org>,
        Lennert Buytenhek <buytenh@....org>, netdev@...r.kernel.org
Subject: Re: [PATCH iproute2-next] Introduce ip-brctl shell script

Hi Nik,

On Wed, 23 Jan 2019 17:09:42 +0200
Nikolay Aleksandrov <nikolay@...ulusnetworks.com> wrote:

> IMO the effort should be towards improving iproute2 to be
> easier to use and more intuitive. We should be pushing people to use
> the new tools instead of trying to find workarounds to keep the old
> tools alive.

Indeed, it's not my intent here to push anybody to do anything.

However, if you think there's some value in familiarising users with
ip-link, we could, very easily with this script, print (perhaps on
standard error?) the equivalent ip-link commands for any brctl command
issued by the user. It's a couple of lines on top of this patch,
because I'm already doing exactly that -- calculating equivalent
ip-link commands. Something like:

	# brctl stp br0 on
	You might want to: "ip link set br0 type bridge stp_state 1"

What do you think?

> I do like to idea of deprecating bridge-utils, but I
> think it should be done via improving ip/bridge enough to be pleasant
> to use.

My observation is that brctl is simply a different tool, not as generic
as ip-link, and hence I find it acceptable and understandable that
users (just as I do, I'll admit) feel more comfortable with it for some
specific tasks.

It's not a matter of syntax, ip-link is device-oriented and brctl is
bridge-oriented. If you want to show a list of bridges and basic
information about enslaved ports, 'brctl show' will do this for you.

With ip-link, you'll need to iterate over devices, and list ports and
information for each of them, while getting a significant amount of
unwanted information in the process. However, getting ip-link to do
something different would make it a different tool.

> We will have to maintain this compatibility layer forever if
> it gets accepted and we'll never get rid of brctl this way.

I see this a bit differently: we're not getting rid of bridge-utils
simply because it makes little sense to do so. It's been several years
now that ip-link is able to access and set all the information and
states brctl uses, but this didn't make brctl obsolete, in practice.

However, getting rid of bridge-utils means bridge-utils doesn't need to
be maintained, and I guess that's the reason you're advocating that.

This is the very reason behind this script: it's smaller and simpler
than bridge-utils, and I think we can reasonably assume it's going to
need almost no maintenance, being a rather dumb implementation.

-- 
Stefano