Re: [PATCH 3.16 289/305] netfilter: x_tables: validate targets of jumps

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!news.mixmin.net!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	Re: [PATCH 3.16 289/305] netfilter: x_tables: validate targets of jumps
Date	Sun, 14 Aug 2016 20:10:03 +0200
Message-ID	<s63uy-83-11@gated-at.bofh.it> (permalink)
References	<s5LnX-4sk-3@gated-at.bofh.it> <s61Cq-7hw-25@gated-at.bofh.it> <s61Cq-7hw-23@gated-at.bofh.it>
X-Original-To	Florian Westphal <fw@strlen.de>
Content-Type	multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-dp3o8t7nQrpIUhxGd+yd"
X-Mailer	Evolution 3.20.4-1
MIME-Version	1.0
X-Sa-Exim-Connect-IP	92.40.248.79
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	66
Organization	linux.* mail to news gateway
X-Original-Cc	linux-kernel@vger.kernel.org, stable@vger.kernel.org, akpm@linux-foundation.org, Pablo Neira Ayuso <pablo@netfilter.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
X-Original-Date	Sat, 13 Aug 2016 19:51:35 +0100
X-Original-Message-ID	<1471114295.13300.22.camel@decadent.org.uk>
X-Original-References	<lsq.1471110169.907390585@decadent.org.uk> <lsq.1471110171.157444531@decadent.org.uk> <20160813183048.GA17154@breakpoint.cc>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1462255

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sat, 2016-08-13 at 20:30 +0200, Florian Westphal wrote:
> > Ben Hutchings <ben@decadent.org.uk> wrote:
> > 
> > 3.16.37-rc1 review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > > > From: Florian Westphal <fw@strlen.de>
> > 
> > commit 36472341017529e2b12573093cc0f68719300997 upstream.
> 
> [..]
> 
> > 
> > The extra overhead is negible, even with absurd cases.
> 
> Not true, the overhead is huge and increases restore time for
> large rulesets from mere seconds to minutes, see
> 
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f4dc77713f8016d2e8a3295e1c9c53a21f296def

So do you think I should add that to this update or defer the netfilter
changes to the next update?

Ben.

-- 
Ben Hutchings
Everything should be made as simple as possible, but not simpler.
                                                           - Albert
Einstein

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [PATCH 3.16 289/305] netfilter: x_tables: validate targets of  jumps Florian Westphal <fw@strlen.de> - 2016-08-14 13:20 +0200
  Re: [PATCH 3.16 289/305] netfilter: x_tables: validate targets of  jumps Florian Westphal <fw@strlen.de> - 2016-08-14 15:20 +0200
    Re: [PATCH 3.16 289/305] netfilter: x_tables: validate targets of  jumps Ben Hutchings <ben@decadent.org.uk> - 2016-08-17 02:30 +0200
  Re: [PATCH 3.16 289/305] netfilter: x_tables: validate targets of  jumps Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200

csiph-web