On Tue, Mar 04, 2025 at 04:39:02PM -0800, Bobby Eshleman wrote: > I think it might be a lot of complexity to bring into the picture from > netdev, and I'm not sure there is a big win since the vsock device could > also have a vsock->net itself? I think the complexity will come from the > address translation, which I don't think netdev buys us because there > would still be all of the work work to support vsock in netfilter? Ugh. Guys, let's remember what vsock is. It's a replacement for the serial device with an interface that's easier for userspace to consume, as you get the demultiplexing by the port number. The whole point of vsock is that people do not want any firewalling, filtering, or management on it. It needs to work with no configuration even if networking is misconfigured or blocked. -- MST
