Hi, On Sun 04 Dec 2011 10:06:12 PM CET, Jan Engelhardt wrote: > On Wednesday 2011-11-30 19:22, Pablo Neira Ayuso wrote: >>> As for 1, you can use genetlink, just as I do for the copy of ipset >>> in xtables-addons. Being forced to use nfnetlink has been point of >>> much discussion and ultimately, nobody was able to provide a >>> technical reason on why nfnetlink is better. Thanks for the suggestion, guys. We could definitely use genetlink instead of nfnetlink for the userspace-kernelspace communication stuff. However, this still leaves us with the second problem -- registering a conntrack extension without recompiling the conntrack module. That one is still more or less a show-stopper for us, unless we implement our own state table effectively duplicating the features of the conntrack hash and do a lookup every time we need policy information. Neither of these options is particularly nice. -- KOVACS Krisztian -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
