Messages in this thread | | | Date | Sat, 09 Aug 2008 09:04:41 -0500 | From | Steve Wise <> | Subject | Re: [RFC][PATCH 1/1] cxgb3i: cxgb3 iSCSI initiator |
| |
David Miller wrote: > From: Jeff Garzik <jgarzik@pobox.com> > Date: Fri, 08 Aug 2008 18:15:41 -0400 > > >> * security updates for TCP problems mean that a single IP address can be >> PARTIALLY SECURE, because security updates for kernel TCP stack and >> h/w's firmware are inevitably updated separately (even if distributed >> and compiled together). Yay, we are introducing a wonderful new >> security problem here. >> >> * from a security, network scanner and packet classifier point of view, >> a single IP address no longer behaves like Linux. It behaves like >> Linux... sometime. Depending on whether it is a magic TCP port or not. >> > > I agree with everything Jeff has stated. > > Also, I find it ironic that the port abduction is being asked for in > order to be "compatible with existing tools" yet in fact this stuff > breaks everything. You can't netfilter this traffic, you can't apply > qdiscs to it, you can't execut TC actions on them, you can't do > segmentation offload on them, you can't look for the usual TCP MIB > statistics on the connection, etc. etc. etc. > > It is broken from every possible angle. >
I think a lot of these _could_ be implemented and integrated with the standard tools.
| |