netdev - Re: [PATCH net-next,v2 0/9] netfilter: flowtable bridge and vlan enhancements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201015230426.GA15673@salvia>
Date:   Fri, 16 Oct 2020 01:04:26 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     netfilter-devel@...r.kernel.org, davem@...emloft.net,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next,v2 0/9] netfilter: flowtable bridge and vlan
 enhancements

On Thu, Oct 15, 2020 at 12:47:48PM -0700, Jakub Kicinski wrote:
> On Thu, 15 Oct 2020 18:30:29 +0200 Pablo Neira Ayuso wrote:
> > The following patchset adds infrastructure to augment the Netfilter
> > flowtable fastpath [1] to support for local network topologies that
> > combine IP forwarding, bridge and vlan devices.
> > 
> > A typical scenario that can benefit from this infrastructure is composed
> > of several VMs connected to bridge ports where the bridge master device
> > 'br0' has an IP address. A DHCP server is also assumed to be running to
> > provide connectivity to the VMs. The VMs reach the Internet through
> > 'br0' as default gateway, which makes the packet enter the IP forwarding
> > path. Then, netfilter is used to NAT the packets before they leave to
> > through the wan device.
> 
> Hi Pablo, I should have looked at this closer yesterday, but I think it
> warrants a little more review than we can afford right now. 
> 
> Let's take it after the merge window, sorry!

I understand, I admit it was a bit late patchset.

I have to say that I'm dissapointed. I cannot avoid shaking the
feeling that there is always a reason to push back for Netfilter
stuff.

Probably it's not fair to mention this in this case.

It's just a personal perception, so I might be really wrong about it.