Re: NFNL_NFA_NEST

[Pablo Neira Ayuso <pablo@netfilter.org>]

Patrick McHardy wrote:
> Pablo Neira Ayuso wrote:
>> Patrick McHardy wrote:
>>
>>> One of the worst mistakes in nfnetlink in my opinion was the
>>> introduction of the NFNL_NFA_NEST bit. It prevents us from
>>> using a large part of the generic netlink stuff, since that
>>> just interprets it as a really huge attribute type. Since
>>> its not used even for anything, this is really annoying.
>>
>> I'm using this bit to convert attribute headers from host byte order to
>> network byte order in conntrackd. I'm unsure about how I would do the
>> conversion if we remove such bit.
> 
> That was the original idea behind it. But where do we use host byte
> order?

Currently, some parts of the nfnetlink message are in host byte order
and some in network byte order. For example, the netlink header and the
attribute header (TL) are un host byte order, but the attribute values
(V) are in network byte order.

Having a look at the code, if we decide to remove the nested bit,
conntrackd will have to parse the message coming from the kernel, put in
a nf_conntrack object and generate a new message un network byte order.
Moreover, I'll have to extend libnfnetlink and libnetfilter_conntrack to
indicate the byte order of a certain nfnetlink message, since without
the nested bit, I can't do proxying anymore.

>>> Unfortunately there is no easy way to get rid of it, current
>>> userspace code sends it to the kernel, so even if we stop
>>> including it in the kernel, we need to deal with it for
>>> compatibilty.
>>
>> We have a field in the nfnetlink that contains the protocol version that
>> we can use for this kind of changes without breaking backward.
> 
> If we still support the old stuff we can't get rid of it.
> I would really like to remove all the duplicated code and
> use the much nicer netlink infrastructure we have today.

I'm fine with using the new netlink infrastructure. We could remove the
nested bit, release new libraries that don't send it to kernel anymore
and keep the old nfnetlink code that understand the nest bit thing for
quite some time. Thus, doing the port to the new infrastructure later.

Thoughts?

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris