netdev - Re: [PATCH net-next,v2 0/9] netfilter: flowtable bridge and vlan enhancements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201015124748.7793cbda@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Thu, 15 Oct 2020 12:47:48 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     netfilter-devel@...r.kernel.org, davem@...emloft.net,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next,v2 0/9] netfilter: flowtable bridge and vlan
 enhancements

On Thu, 15 Oct 2020 18:30:29 +0200 Pablo Neira Ayuso wrote:
> The following patchset adds infrastructure to augment the Netfilter
> flowtable fastpath [1] to support for local network topologies that
> combine IP forwarding, bridge and vlan devices.
> 
> A typical scenario that can benefit from this infrastructure is composed
> of several VMs connected to bridge ports where the bridge master device
> 'br0' has an IP address. A DHCP server is also assumed to be running to
> provide connectivity to the VMs. The VMs reach the Internet through
> 'br0' as default gateway, which makes the packet enter the IP forwarding
> path. Then, netfilter is used to NAT the packets before they leave to
> through the wan device.

Hi Pablo, I should have looked at this closer yesterday, but I think it
warrants a little more review than we can afford right now. 

Let's take it after the merge window, sorry!