Re: [RFC][DRAFT][PATCH] iptables 32bit compat layer

["David S. Miller" <davem@davemloft.net>]

From: Kirill Korotaev <dev@openvz.org>
Date: Wed, 18 Jan 2006 12:12:54 +0300

> This patch extends current iptables compatibility layer in order to get
> 32bit iptables to work on 64bit kernel. Current layer is insufficient 
> due to alignment checks both in kernel and user space tools. Current 
> draft version works correctly with standard targets only 
> (ACCEPT/DROP/FORWARD).
> 
> ToDo:
>   - extend translation to include more matches and targets. Use arrays of
>     structures like { name, size_diff, func_for_convert_data} for this
>     purpose
>   - extend get_info to return corrected size. Add size calculation to
>     get_entries.

Thanks for doing this work.

But it would make a lot more sense to add
compat_setsockopt and compat_getsockopt socket
operations, call down into there, and then implement
these translations inside of netfilter itself.

This would avoid an enormous amount of copying
and munging, and also would keep netfilter internals
outside of the generic socket compat layer code.

Thanks.