Re: NPF: fast kick

[Maxime Villard <max%m00nbsd.net@localhost>]

Le 13/03/2018 à 00:23, Mindaugas Rasiukevicius a écrit :
>  [...]

I think our disagreement/misunderstanding comes down to this paragraph:

> - NPF should perform minimum sanity checks to be able to read the basic
> L3 payload from the packet for its own operation (-- I don't think we have
> a disagreement here).  However, generally, the *default rule* decides
> whether unrecognizable (or malformed) packets are passed or not; this is
> more or less how other packet filters work too.

The change I made was exactly your first sentence: perform minimum sanity
checks, to ensure the basic operation of NPF. If the basic operation cannot
be assured, then fast-kick the packet.

If you pass the packet to the ruleset machinery, things can go wrong, because
the basic operation of the machinery cannot be assured.

Maxime