Re: NFNL_NFA_NEST

[Pablo Neira Ayuso <pablo@netfilter.org>]

Patrick McHardy wrote:
> One of the worst mistakes in nfnetlink in my opinion was the
> introduction of the NFNL_NFA_NEST bit. It prevents us from
> using a large part of the generic netlink stuff, since that
> just interprets it as a really huge attribute type. Since
> its not used even for anything, this is really annoying.

I'm using this bit to convert attribute headers from host byte order to
network byte order in conntrackd. I'm unsure about how I would do the
conversion if we remove such bit.

> Unfortunately there is no easy way to get rid of it, current
> userspace code sends it to the kernel, so even if we stop
> including it in the kernel, we need to deal with it for
> compatibilty.

We have a field in the nfnetlink that contains the protocol version that
we can use for this kind of changes without breaking backward.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris