Re: [RFC] new API for libnetfilter_conntrack

[Pablo Neira Ayuso <pablo@netfilter.org>]

Harald Welte wrote:
>> This will result in a single library to rules them all with a
>> subdirectory that contains the details of every specific subsystem.
> 
> I disagree with that proposition.  I don't really understand why
> completely independent netfilter subsystems should share a high-level
> userspace library.  Every time some obscure bug in libnetfilter_log
> happens, libnetfilter_conntrack will be affected, too.
> 
> This is especially difficult if meanwhile you have commited
> not-yet-completely-stable code for one subsystem, and then need to make
> a bugfix releease of the other (svn branching is an option, but it all
> sounds a bit too complex for my taste).

Yes, this is a tricky issue, although the libraries are relatively small 
in terms of code and the impact of such problem could be reduced if we 
do frequent releases.

> One option would be implement the subsystem specific parts as plugins
> and to dlopen() them at runtime, providing a way of updating only
> individual subystem-plugins

As I posted days ago, this is an alternative that I like, such dlopen() 
would require a versioning mechanism, the only concerned here is about 
getting people confused with this modular view.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris