Re: NFNL_NFA_NEST

[Pablo Neira Ayuso <pablo@netfilter.org>]

Pablo Neira Ayuso wrote:
> I implemented a simple conversion function yesterday, so we can get rid 
> of it for this library release. Anyhow, I'm still concerned about one 
> scenario, since netlink over network messages could be sent between two 
> systems A and B with different endianess and different library versions, 
> consider that A sent a message that contains one attribute that B 
> doesn't know. Thus, the message will not be completely converted by the 
> structure aware proxy function in B. Then, the message will probably be 
> passed to B's netlink subsystem that will complain about a malformed 
> attribute, returning EINVAL. For the conntrackd example, both replicas 
> should have the same configuration, so this shouldn't be a problem for 
> me, but perhaps other future applications could have problems. Another 
> point is that we'll have to cook a structure aware conversion function 
> for every netlink messages sent on the wire.

Perhaps the example above probably looks pretty strange. Still, think of 
old libraries and new kernels with one new nested attribute, the 
conversion function will miss the conversion for it. This bit thing gets 
me stressed me a bit :)

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris