tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: NPF: fast kick

Le 13/03/2018 à 00:23, Mindaugas Rasiukevicius a écrit :

I think our disagreement/misunderstanding comes down to this paragraph:

- NPF should perform minimum sanity checks to be able to read the basic
L3 payload from the packet for its own operation (-- I don't think we have
a disagreement here).  However, generally, the *default rule* decides
whether unrecognizable (or malformed) packets are passed or not; this is
more or less how other packet filters work too.

The change I made was exactly your first sentence: perform minimum sanity
checks, to ensure the basic operation of NPF. If the basic operation cannot
be assured, then fast-kick the packet.

If you pass the packet to the ruleset machinery, things can go wrong, because
the basic operation of the machinery cannot be assured.


Home | Main Index | Thread Index | Old Index