From: Felix Fietkau <n...@nbd.name>
Date: Mon, 12 Mar 2018 20:30:01 +0100
> It's not dead and useless. In its current state, it has a software fast
> path that significantly improves nftables routing/NAT throughput,
> especially on embedded devices.
> On some devices, I've seen "only" 20% throughput improvement (along with
> CPU usage reduction), on others it's quite a bit lot more. This is
> without any extra drivers or patches aside from what's posted.
I wonder if this software fast path has the exploitability problems that
things like the ipv4 routing cache and the per-cpu flow cache both had.
And the reason for which both were removed.
I don't see how you can avoid this problem.
I'm willing to be shown otherwise :-)