From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jan Engelhardt <jengelh@medozas.de>
Cc: netfilter@vger.kernel.org,
Netfilter Developer Mailing List
<netfilter-devel@vger.kernel.org>,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Subject: Re: Xtables-addons 1.32/ipset-GENL 5.2
Date: Thu, 06 Jan 2011 03:11:39 +0100 [thread overview]
Message-ID: <4D2524DB.8090408@netfilter.org> (raw)
In-Reply-To: <alpine.LNX.2.01.1101040456270.11091@obet.zrqbmnf.qr>
On 04/01/11 05:14, Jan Engelhardt wrote:
> 'ちわ
>
> So a few people had been asking on whether ipset 5.x will be bundled
> along with Xtables-addons. Naturally this is a difficult question
> because ipset-5 wants a kernel patch. But yes, it is included as of Xt-a
> 1.32 (just out).
>
> It has been augmented to not require the patch anymore, by moving it
> over from nfnetlink (booo) to genetlink which does not depend on static
> numbers, though you will need at least Linux 2.6.35 for this GENL
> variant in both compilation and at runtime.
Not depending of static numbers is a good thing to me because it makes
the whole user-space simpler since: a) you don't have to send a message
to perform the initial family ID lookup and b) you don't have to
subscribe to genl control events (which is required since the the
floating family number may change if the module is unloaded).
> (As such, ipset-5 is deactivated by default in Xt-a 1.32 and needs to be
> turned on in mconfig.)
>
> Xt-a files at the usual place.
>
> The plain genl patch to ipset-5 can be found as a commit at
> git://dev.medozas.de/ipset in the "genl" branch. It has received a run
> through the testsuite (as far as it went until ospf), and I take that as
> an indication that proxying the protocol onto genl was successful.
This is going to confuse everyone. Since ipset-5 will be submitted into
mainline soon, some distributors may start packaging the user-space genl
binaries. Then, once we have it into the kernel, the distributed version
will not work with the one running upon nfnetlink.
I think it's way easier to submit a patch to reserve the subsystem ID
for ipset than adding this genl compatibility layer.
BTW, Jozsef, do you plan to submit ipset for the next linux kernel
release cycle?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2011-01-06 2:11 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-04 4:14 Xtables-addons 1.32/ipset-GENL 5.2 Jan Engelhardt
2011-01-05 9:22 ` Jozsef Kadlecsik
2011-01-05 12:08 ` Jan Engelhardt
2011-01-05 15:52 ` Mr Dash Four
2011-01-05 20:29 ` Jozsef Kadlecsik
2011-01-06 2:11 ` Pablo Neira Ayuso [this message]
2011-01-06 3:21 ` Jan Engelhardt
2011-01-06 9:46 ` Jozsef Kadlecsik
2011-01-06 13:12 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D2524DB.8090408@netfilter.org \
--to=pablo@netfilter.org \
--cc=jengelh@medozas.de \
--cc=kadlec@blackhole.kfki.hu \
--cc=netfilter-devel@vger.kernel.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).