Subject: Re: [PATCH RFC 0/4] net: add bpfilter

From: Phil Sutter <[email-masked]>
Date: Tue, 20 Feb 2018 14:05:49 +0100

Hi David,

On Mon, Feb 19, 2018 at 12:15:37PM -0500, David Miller wrote:
> From: Phil Sutter <[email-masked]>
> Date: Mon, 19 Feb 2018 18:09:39 +0100
> 
> > What puzzles me about your argumentation is that you seem to propose for
> > the kernel to cover up flaws in userspace. Spinning this concept further
> > would mean that if there would be an old bug in iproute2 we should think
> > of adding a workaround to rtnetlink interface in kernel because
> > containers will keep the old iproute2 binary? Or am I (hopefully) just
> > missing your point?
> 
> I'll answer this with a question.  I tried to remove UFO entirely from
> the kernel, did you see how that went?

:)

I didn't follow back then, but found mails about KVM live migration
breakage when moving to a kernel without UFO. But isn't that a problem
with how virtio_net optimizes things? Florian recently told me how
iptables CHECKSUM target was mainly introduced to overcome a different
problem in the same area. So all this is kernel covering up for kernel
problems. My question was about covering up for userspace bugs in
kernelspace. If you think that is preferable over fixing userspace, I
have to put that in consideration when dealing with userspace issues.

Cheers, Phil