Re: [PATCH 1/*] nfnetlink updates

[Harald Welte <laforge@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1546 bytes --]

Hi Pablo, thanks for your patches.

On Tue, Jul 12, 2005 at 10:35:01PM +0200, Pablo Neira wrote:

> a) nfnetlink groups: Up to 32 maximum.
> 
> +#define NF_NETLINK_CONNTRACK_NEW       0x1
> +#define NF_NETLINK_CONNTRACK_UPDATE    0x2
> +#define NF_NETLINK_CONNTRACK_DESTROY   0x4
> +#define NF_NETLINK_CONNTRACK_EXPECT    0x8
> 
> I think that those four groups are enough to group events.
>
> d) NFNL_SUBSYS_CTNETLINK_EXP has been killed. This is superseded by the group 
> NF_NETLINK_CONNTRACK_EXPECT.
> 

Patrick and me have just discussed this subject, and we thought it would
be better to only have the first three groups and keep the expectations
in their own subsys.  This seems more orthogonal, so the group tells you
the kind of event (new/update/destroy), and the subsystem indicates
conntrack/expect.

> e) nfnetlink_subsystem internal list isn't used, the array is enough.

great.

Ok, so with the minor change above, I think all of the changes are fine.

I've just reworked the conntrack event cache to work without requiring
skb->nfcache.  I'll try to merge all the code and produce some working
version which I'll put in svn.

-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]