Re: patch for iptables

[Pablo Neira Ayuso <pablo@netfilter.org>]

Massimiliano Hofer wrote:
> I was so careful testing my new version of condition for binary compatiblity 
> that I didnt't notice it breaks recompilation of the userspace utilities. :)
> 
> Here is a patch that uses the new include for the XT version. While I was at 
> it, I updated the sanity checks in order to match the module ones.
> 
> One caveat: I break compatibility with older kernels that don't have XT. 
> What's the policy for backward compatibility in iptables? Shall I put a few 
> #ifdefs?

The official policy is "do not break backward" :). IHMO, if we want to 
go further with iptables we need to think about providing a netlink API.

For out-of-tree stuff the thing can be different, I have seen breakages 
if it really required it. For example, the string match is not 
compatible with the old and broken match for 2.4.

Please see below a comment about your patch:

> ------------------------------------------------------------------------
> 
> diff -Nru iptables-1.3.5-20060820.orig/extensions/.condition-test iptables-1.3.5-20060820/extensions/.condition-test
> --- iptables-1.3.5-20060820.orig/extensions/.condition-test	2006-08-21 02:22:24.000000000 +0200
> +++ iptables-1.3.5-20060820/extensions/.condition-test	2006-08-21 02:39:15.000000000 +0200
> @@ -1,3 +1,3 @@
>  #!/bin/sh
>  # True if condition is applied.
> -[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_condition.h ] && echo condition
> +[ -f $KERNEL_DIR/include/linux/netfilter/xt_condition.h ] && echo condition

You don't need to break it. Just put a dummy ipt_condition.h file that 
points to xt_condition.h

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris