Date: Thu, 9 Jul 2020 12:44:25 -0700 From: Doug Hardie <bc979@lafn.org> To: Mark Johnston <markj@freebsd.org> Cc: freebsd-net@freebsd.org, tuexen@freebsd.org Subject: Re: making SCTP loadable and removing it from GENERIC Message-ID: <63F4446F-DECF-4DE8-99CA-EC8755A5D4A1@mail.sermon-archive.info> In-Reply-To: <20200709151300.GC8947@raichu> References: <20200709151300.GC8947@raichu>
next in thread | previous in thread | raw e-mail | index | archive | help
> On 9 July 2020, at 08:13, Mark Johnston <markj@freebsd.org> wrote: >=20 > Hi, >=20 > I spent some time working on making it possible to load the SCTP stack > as a kernel module, the same as we do today with IPSec. There is one > patch remaining to be committed before that can be done in head. One > caveat is that the module can't be unloaded, as some work is needed to > make this safe. However, this obviously isn't a regression. >=20 > The work is based on the observations that: > 1) the in-kernel SCTP stack is not widely used (I know that the same > code is used in some userland applications), and > 2) the SCTP stack is quite large, most FreeBSD kernel developers are > unfamiliar with it, and bugs in it can easily lead to security = holes. >=20 > Michael has done a lot of work to fix issues in the SCTP code, > particularly those found by syzkaller, but given that in-kernel SCTP = has > few users (almost certainly fewer than IPSec), it seems reasonable to > require users to opt in to having an SCTP stack with a simple "kldload > sctp". Thus, once the last patch is committed I would like to propose > removing "options SCTP" from GENERIC kernel configs in head, replacing > it with "options SCTP_SUPPORT" to enable sctp.ko to be loaded. >=20 > I am wondering if anyone has any objections to or concerns about this > proposal. Any feedback is appreciated. I have a number of systems using SCTP. It is a key part of a = distributed application. As a user of SCTP, I have a slight objection = to removing it from the kernel. It would require me to remember when = setting up a new system to enable that. I am not likely to remember. = What is going to happen if you run an application that uses SCTP and the = module is not loaded? What will remind me how to fix the issue? I am = not likely to remember about this 6 months from now. -- Doug=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?63F4446F-DECF-4DE8-99CA-EC8755A5D4A1>