On Tue, Sep 16, 2003 at 11:18:34AM +0200, Henrik Nordstrom wrote:
> tis 2003-09-16 klockan 08.02 skrev David S. Miller:
>
> > Also, another solution could be to store the object inside the kernel
> > using a different structure, one where you can guarentee the alignment
> > of these things properly.
>
> unfortunately iptables does not allow such differences between userspace
> and kernel representation..
yes. yes. yes. The whole 'kernel internal data structure exported to
userspace' is a fundamental design flaw of iptables. There's nothing we
can do about it, we'll have to live with it :(
That's why the yet-to-be-completed pkttables will use what I call vTLV's
(versioned TLV's) for all [netlink based] kernel-userspace
communication.
> Henrik Nordstrom <hno@xxxxxxxxxxxxxxx>
> MARA Systems AB
--
- Harald Welte <laforge@xxxxxxxxxxxxx> http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
pgpIkJyn5qdXc.pgp
Description: PGP signature
|