Re: NFNL_NFA_NEST

[Pablo Neira Ayuso <pablo@netfilter.org>]

Patrick McHardy wrote:
> Pablo Neira Ayuso wrote:
>> I just started thinking that probably the generic infrastructure should
>> support the nest bit. How crazy is this idea?
> 
> I don't know. It could accept them on the receive side without
> further problems since probably no netlink user will define
> more than 2^15 attributes, but could not send it since that
> would break compatibility. Since the kernel doesn't need it
> at all not sending it from userspace seems like a better
> solution to me.

Hm, then we'll have different message formats depending on the source.
If there is no choice I think that I prefer to keep it homogeneous, use
the conversion function and live with the library issues.

Alternatively, we could add support for the nest bit in the receive side
of genetlink and OR the nest bit in nfnetlink for messages sent to
userspace.

Thomas, do you have any suggestion on where to go?

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris