Re: [ANNOUNCE] netfilter-2.6.14 git tree / TODO

[Eric Leblond <eric@inl.fr>]

[-- Attachment #1: Type: text/plain, Size: 1950 bytes --]

On Sun, 2005-07-31 at 12:38 +0200, Harald Welte wrote:
> On Sun, Jul 31, 2005 at 11:29:53AM +0200, Eric Leblond wrote:
> > Hi,
> > 
> > On Sun, 2005-07-31 at 10:01 +0200, Harald Welte wrote:
> > > Hi!

> > So, we are really interested in userspace counterparts. In particular,
> > our center of interest is libnfnetlink_queue. I will do some test in
> > the coming days to check if NuFW is working with NFQUEUE.
> 
> great.  Please consider supporting nfnetlink_queue natively, rather than
> using the (still incomplete) compat_libipq interface.  The latter has to
> do one additional copy of every packet (to build the fake
> ipq_packet_msg_t), which you definitely want to avoid.

Ok, I will work in that direction.


> The problem are the optional attributes.  A packet from the kernel could
> optionally contain
> 	PAYLOAD
> 	MARK
> 	TIMESTAMP
> 	IFINDEX_IN
> 	IFINDEX_OUT
> 	...
> and this may change from packet to packet.  so we cannot just pass a
> fixed structure to the application program like libipq did.  OTOTH, I
> don't want the applications have to do their own netlink message parsing
> (with NFA_... macros), since that would violate the layering. Any ideas?

It reminds me the problem we had when we had to define the NuFW
protocols. We take the idea from radius protocol which can contains an
arbitrary number of fields. This works as follow : 
start of the message contains the type of the message and its length
(calculate from the content). Then we have fields all optional
containing their type, option and length

Decomposition is the following :
MSG type | option | length
field type | option | length
DATA of field
field type | option | length
DATA of field
...
field type | option | length
DATA of field

It can easily be extended for any new fields as long as there is room in
the field type interval.

Hope this can help.

BR,
-- 
Eric Leblond <eric@inl.fr>
INL

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]