Re: [PATCH NF_CONNTRACK] compatible ipt_conntrack

[Patrick McHardy <kaber@trash.net>]

David S. Miller wrote:
> From: Patrick McHardy <kaber@trash.net>
> Date: Mon, 29 Aug 2005 13:14:49 +0200
> 
> 
>>I feel reluctant to add complexity just so users can switch between
>>them at runtime. It may be useful for debugging, but it doesn't look
>>like a realistic usage scenario. So I would also prefer having a
>>compile-time choice.
> 
> 
> What do you expect distribution vendors to do?  They keep both
> ipchains and iptables enabled to this day so people can still
> use their old firewalling scripts and setups.
> 
> Unless you provide %100 of the existing functionality in the new stuff
> you have to allow the new stuff to coexist with the older stuff in a
> build else distribution vendors will simply ship the new stuff
> disabled, and stay with the old stuff.
> 
> I really don't see compile time selection as a viable option.
> Do you?

The plan would be to provide all existing functionality as soon as
possible. The targets and matches should be easy with a compile-time
selections, one or two conntrack helpers still need to ported and NAT
needs to be made possible. It all sounds doable in not too long time,
after that I would expect to get significantly more exposure by a
compile-time option because vendors want the IPv6 support. Of course
I'm open for suggestions ..