Acabo de leer en el blog de Rusty Rusell (el creador de netfilter) una gran frase, en el que destaca las virtudes positivas del entorno "arisco" que hay en el kernel y la poquísima tolerancia que hay frente a la basura (actitud que no se ve en "otros proyectos", y así les va, haciendo rondas de optimización y de reducción de memoria a su software años despues de haber sacado la primera version estable porque ya no entra mas basura en el cubo):
"One thing I gained from working on the kernel: a good sense of when code is crap. If my code is good, it is not because I am smart, but because I refuse to release stuff which stinks, so I'm forced to spend time cleaning it up. The harsh environment of the linux-kernel mailing list trains you to do this yourself
I'm reluctant to harshly criticize the code of others, because I am aware how hurtful such words can be. On the other hand, without such harshness, you end up, say, using a helper thread in the implementation of a library. Not because you're stupid, but because you haven't developed a pavlovian shudder at the thought of releasing such a thing"
Y para los que no lo conozcan, aquí esta la "netfilter song" de rusty que le dió por postear un día como respuesta a un email que preguntaba como funcionaba netfilter:
> The biggest difference is that INPUT chains NOW *behind* "routing
> decision".
>
> So what is the real path of packet?
>
> Rusty?
Rusty reading netfilter:
______
/ / \ / o o \ .____, /
\______/
^^^ ^^^
[TABqwertyiop[]\]
My ASCII art sucks, I know. Perhaps I should try a different form of
expression:
When a packet on a network
Enters Linux from a NIC,
Or PPP, ISDN,
Or even via SL/IP,
It goes right into net_bh,
Which sees it is IP,
And hands it via ptype->func()
To old ip_rcv(). [pron: `EYE-PEE receive']
This calls the PRE_ROUTING hook,
Where ipfwadm was, [pron: `EYE-PEE-FWADM']
And ipchains lived here as well,
But not iptables, 'cause...
PRE_ROUTING is for NAT NAT NAT,
Redirection and so on,
Inadaquate for filtering,
So iptables is gone...
To LOCAL_IN, the one true hook,
Where filtering ought to be,
Because we know this very box,
Is its destiny.
On the way out, it's just the same,
'Cause filtering now takes place
As local packets leave the box,
In LOCAL_OUT, with grace.
But what, you ask, are we to do
About packets passing through?
Where should we now filter them
Please give us this one clue?
Not in PRE_ROUTING nor in POST,
We don't need three ways here,
The one true place to filter these,
Is the FORWARD hook, it's clear.
The FORWARD hook is just the same,
But we've added just one thing,
You get incoming interface,
As well as outgoing.
Chorus:
iptables is so cool,
It makes my packets sing,
That Rusty he is one hot coder,
OOPS: my box is crashing...
Rusty.
