Re: iptables pull request

[Pablo Neira Ayuso <pablo@netfilter.org>]

Jan Engelhardt wrote:
> I do not think we planned for a stable API - but feel free to ask Jamal. 
> The main target was ABI, because... - I am not sure how m_ipt did it, 
> but I seem to remember that despite version checks (ie. struct 
> xtables_match->version) it provided an iptables-like API that was not 
> actually that from the respective iptables version. Or something.

Well, IMO if this is intended to be a public API it should be stable.

> I am not sure what m_ipt did previously w.r.t. checks, but there are now 
> various mechanisms in place to ensure ABIs do not get mixed up 
> erroneously:
> 
> - soversion. m_ipt now links against, say, libxtables.so.2. If the 
> latter changes incompatibly, it becomes libxtables.so.3, and the 
> runtime linker ld.so will take care of it -- by throwing a "file not 
> found" error, or by actually loading a still-existing .so.2.
> 
> - libxtables will not load extensions that have a mismatching soversion 
> string
> 
> - lastly, we could make it so that every extension is backlinked to 
> libxtables.so.$version as an added measure but I had not yet given 
> thought of the impact that it causes for running iptables directly from 
> the source directory.

Aware of all of those, but I think that we should not abuse these
because versioning is not a solution, it's more like a workaround. If we
change the ABI over and over again, this will result in binary breakages
and really bad experience from the user side.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers