Re: [NETFILTER]: Kill ebt_ulog

[Harald Welte <laforge@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 2385 bytes --]

On Sat, Jul 23, 2005 at 09:34:39PM +0000, Bart De Schuymer wrote:
> Op za, 23-07-2005 te 22:04 +0200, schreef Patrick McHardy:
> > The QUEUE target will get a queue-number argument. Userspace can
> > register for different queues using netlink messages. All this
> > will be handled by the core to we don't need ipt_ULOG/ebt_ulog
> > anymore.
> 
> What if someone wants to just get a copy sent to userspace while the
> kernel continues routing the copied packet? AFAIK this behaviour can't
> be obtained using the queue target.

> > The problem is that we can't create two kernel sockets for the same
> > netlink family. Netlink families are a scarce resource, so I don't think
> > it makes much sense to waste another one for a soon (couple of days)
> > deprecated mechanism. I propose to continue this discussion once the
> > new code is there, so we can see if it fits your needs.
> 
> If the generic code is such that other modules can make it send messages
> through the NETLINK_NFLOG socket, then those problems are over. I think
> there is no problem in keeping ULOG and QUEUE as long as they use the
> generic framework, those targets do different things.

yes, that is what I'm doing at the moment.  nfnetlink_nflog is
registering with the already-existing nf_log_packet() api.

The architecture is like follows:

The iptables LOG (and ebt_ulog) modules would do nothing else but do a
single call to nf_log_packet() every time the want to log a packet.
nf_log_packet() will be extended to specify the log group.

Everything else is dealt with by the core.  A userspace process can use
nfnetlink to tell the kernel "please register as nf_log_packet() handler
for PF_BRIDGE, PF_INET, ... - and then register to one or multipe
groups. 

> I'll be unreachable, most of the time, from July 25 'till August 7, I
> hope I can catch up on the discussion then...

the new code should be fixed until then.  I'm resolving some oopses at
the moment, it's a matter of days..

-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]