Re: nfnetlink and conntrack extension question

[KOVACS Krisztian <hidden@balabit.hu>]

Hi,

On Sun 04 Dec 2011 10:06:12 PM CET, Jan Engelhardt wrote:
> On Wednesday 2011-11-30 19:22, Pablo Neira Ayuso wrote:
>>> As for 1, you can use genetlink, just as I do for the copy of ipset
>>> in xtables-addons. Being forced to use nfnetlink has been point of
>>> much discussion and ultimately, nobody was able to provide a
>>> technical reason on why nfnetlink is better.

Thanks for the suggestion, guys. We could definitely use genetlink 
instead of nfnetlink for the userspace-kernelspace communication stuff.

However, this still leaves us with the second problem -- registering a 
conntrack extension without recompiling the conntrack module. That one 
is still more or less a show-stopper for us, unless we implement our 
own state table effectively duplicating the features of the conntrack 
hash and do a lookup every time we need policy information. Neither of 
these options is particularly nice.

-- 
KOVACS Krisztian