From: Felix Fietkau <nbd@xxxxxxxx> Date: Mon, 12 Mar 2018 20:30:01 +0100 > It's not dead and useless. In its current state, it has a software fast > path that significantly improves nftables routing/NAT throughput, > especially on embedded devices. > On some devices, I've seen "only" 20% throughput improvement (along with > CPU usage reduction), on others it's quite a bit lot more. This is > without any extra drivers or patches aside from what's posted. I wonder if this software fast path has the exploitability problems that things like the ipv4 routing cache and the per-cpu flow cache both had. And the reason for which both were removed. I don't see how you can avoid this problem. I'm willing to be shown otherwise :-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
