On Thu, Apr 27, 2023 at 03:07:24PM +0200, Pablo Neira Ayuso wrote: > On Thu, Apr 27, 2023 at 01:33:13PM +0200, Phil Sutter wrote: > > On Thu, Apr 27, 2023 at 01:01:55PM +0200, Pablo Neira Ayuso wrote: > > > On Thu, Apr 27, 2023 at 12:57:30PM +0200, Phil Sutter wrote: > > > > Hi Pablo, > > > > > > > > On Wed, Apr 26, 2023 at 09:58:44PM +0200, Pablo Neira Ayuso wrote: > > > > [...] > > > > > My proposal: > > > > > > > > Thanks for returning to this. Your approach requires to define a minimum > > > > version from which on forward-compat is guaranteed. I was trying to > > > > avoid this requirement though so things would work for "unknown user > > > > space". > > > > > > You also require a kernel that supports your approach. > > > > Sure. But in the described use-case, anything but old user space (i.e., > > container content) is under control. > > This is a "forward compatibility" mechanism, we can do nothing about > the past, but prepare to handle this scenario better in the future. > > This problem has been always there, and we already discussed that it > affects other existing utilities and interfaces in the kernel, > including iptables legacy. Yes, sure. If iptables-legacy moved at the pace iptables-nft did and containers were a thing back then, the same situation had arisen. I don't even see us in charge to solve the problem, other tools lack forward compatibility, too. And I have not seen any guarantees about mixed use of different tool versions. The only reason I see for iptables-nft to attempt such a guarantee is its perspective of replacing itself internally with native nftables expressions, in consequence the tendency of each new version to break compatibility for the previous one. Introducing a mode which creates a compatible ruleset for users requiring it should be enough from my point of view. Sure, one may argue it hinders future deprecation of xtables extensions in kernel. But the active use of older versions of iptables-nft does that already. > > > > Currently, the only offending extension is ebt_among since it doesn't > > > > exist (and never did) in non-native form. If I implement among extension > > > > parsing (even in non-functional form), my original approach would work. > > > > This also means having a minimum version for full compat, but it affects > > > > ebtables (actually, use of ebt_among) only. > > > > > > Yes, but this is fully user data, kernel really does not need to do > > > anything with this alternative representation, which is what I do not > > > like from you proposal. > > > > OK. > > > > > I really think userdata is the place to deal with this. > > > > Having to touch old user space is not a good solution for the given > > use-case. If kernel modification is a no-go, I'd rather introduce a > > "compat mode" in iptables-nft which causes rule creation in the most > > compatible form. This might impact run-time performance but is much > > simpler to implement and maintain. > > This introduces conditional bytecode generation, how will you enable > this? Commandline (or input file) parser creates match and target objects which add_match() may or may not turn into native code. In compat mode, one could always allocate a "match" expression and call __add_match(). In turn, nftnl_rule parser creates match and target objects from native expressions (if supported). Upon encountering a "match" object, it merely does an extension lookup and copies the payload into the allocated object. So compat mode is a flag for iptables-nft-restore and 'iptables-nft -A', the reverse path works automatically. Cheers, Phil
