On 10/21/2013 01:07 AM, Steven Haigh wrote:
On 21/10/2013 4:09 AM, Henrique C. S. Junior wrote:
As reported in Slashdot[1] in the near future iptables is going to be
replaced by NFTables in the linux kernel. The project[2] is said to be a
new and best package filtering framework.
Have any of you, guys, tried it already and have some experiences to share?
Does it matter? EL6 won't ever have NFTables support.
EL7 probably won't either. Don't stress and keep doing what you're doing.
Perhaps someone familiar with the choices made by TUV will clarify the
above statement: EL7 probably won't either.
SL and other TUV re-distributors of EL simply build and re-package the
TUV product (removing the logos and non-open copyrighted material, but
keeping all of the internal TUV developer statements -- the actual name
of TUV, that evidently is taboo on this list, is plastered all over the
source code for EL). Thus, the decision as to which family of Linux
kernels to use is a TUV decision.
However, as fundamental new functionality, or repackaging of existing
functionality with a new API, is incorporated into the Linux kernel --
not in an experimental way that may be removed, but in the "stable
production" released version - the high reliability approach requires
that the kernel receives extensive field testing (as happens with
Fedora) as well as stress testing and internal hardening against threats
and compromises that may not be as needed in an enthusiast distribution.
Nonetheless, once a major change (e.g., NFTables replacing iptables) is
done in the base source, the production enterprise version must reflect
the change -- and in less than a decade. Why less than a decade?
Unless there is a fully backward compatible set of APIs, new
applications and revisions typically use the current not historical
APIs. Presumably, there will be NFTables features that application
developers will use that have no iptables backport.
Thus -- how long is the delay? Typically, are two major releases (e.g.,
NFTables in EL8) the usual delay? Does anyone have historical data from
EL/TUV?
Yasha Karant
