Re: [PATCH RFC 0/4] net: add bpfilter

Hi David,

On Mon, Feb 19, 2018 at 12:15:37PM -0500, David Miller wrote:

From: Phil Sutter <phil@nwl.cc>
Date: Mon, 19 Feb 2018 18:09:39 +0100

quoted

What puzzles me about your argumentation is that you seem to propose for
the kernel to cover up flaws in userspace. Spinning this concept further
would mean that if there would be an old bug in iproute2 we should think
of adding a workaround to rtnetlink interface in kernel because
containers will keep the old iproute2 binary? Or am I (hopefully) just
missing your point?

I'll answer this with a question.  I tried to remove UFO entirely from
the kernel, did you see how that went?

:)

I didn't follow back then, but found mails about KVM live migration
breakage when moving to a kernel without UFO. But isn't that a problem
with how virtio_net optimizes things? Florian recently told me how
iptables CHECKSUM target was mainly introduced to overcome a different
problem in the same area. So all this is kernel covering up for kernel
problems. My question was about covering up for userspace bugs in
kernelspace. If you think that is preferable over fixing userspace, I
have to put that in consideration when dealing with userspace issues.

Cheers, Phil