Re: NFNL_NFA_NEST

[Patrick McHardy <kaber@trash.net>]

Pablo Neira Ayuso wrote:
> Pablo Neira Ayuso wrote:
> 
>> I implemented a simple conversion function yesterday, so we can get
>> rid of it for this library release. Anyhow, I'm still concerned about
>> one scenario, since netlink over network messages could be sent
>> between two systems A and B with different endianess and different
>> library versions, consider that A sent a message that contains one
>> attribute that B doesn't know. Thus, the message will not be
>> completely converted by the structure aware proxy function in B. Then,
>> the message will probably be passed to B's netlink subsystem that will
>> complain about a malformed attribute, returning EINVAL. For the
>> conntrackd example, both replicas should have the same configuration,
>> so this shouldn't be a problem for me, but perhaps other future
>> applications could have problems. Another point is that we'll have to
>> cook a structure aware conversion function for every netlink messages
>> sent on the wire.
> 
> 
> Perhaps the example above probably looks pretty strange. Still, think of
> old libraries and new kernels with one new nested attribute, the
> conversion function will miss the conversion for it. This bit thing gets
> me stressed me a bit :)


Yes, thats why we need to keep it long enough so it won't hurt anyone.
IIRC you had planned to fade out the old nfnetlink API anyway, at
that point I guess it won't matter.