Wenn CONFIG_GENERIC_CONNTRACK eine "abgespeckte", AVM-eigene Variante von nf_conntrack ist, wieso läßt sich dann ein Modul mit evtl. "größerem" Funktionsumfang nicht mehr aktivieren ?
Oder hat das wieder mit einer veränderten skbuff-Größe zu tun?
Risking that I write some stuff obvious to many, I try to reason here what the impact of the AVM closed source modules is.
Kernel modules can only be loaded if the used kernel was build with a config that enabled these modules, otherwise the kernel lacks the needed module stubs, and also, kernel modules that use common kernel data structures
must match the definition of the structure used by the kernel. At build time that definition may depend on settings in the kernel config.
Any AVM closed source module cannot be rebuild such that it agrees with eventual changes in the definitions of commonly used data structures. This is by definition, the sources are not available for compilation. (Tough the kernel config settings needed for building a kernel that can load the module is available, thanks to the requirements of the GPLv2).
Therefore when using closed source AVM modules, the definition in the kernel of the common data types like the skbuf structure must match that of the immutable closed source module. This restriction can be lessened a little: the structure used by the kernel may be expanded, but only after the part that matches the definition of the structure as used by the closed source module. This explains why markuschen made a patch that moved additions to the skbuf structure that are needed for NF conntracking
after the part of the structure that is known to the AVM closed sources modules.
Other problems may be caused by the semantics of a module. When a required closed source module implements some semantics that cannot be combined with other modules, these other modules cannot be used.
The following is speculative, since I have not verified whether it is truly the case. AVM's PacketAccelerator (CONFIG_AVM_PA) and its associated generic connection tracking may possibly move packets directly from one interface to another thereby completely bypassing some of NF's tables and associated logic. As stated: I do not know whether this is true.
As long as AVM can build and distribute modules that they do not consider to be "derived work" in terms of the GPL2 (which would imply that the source code should be made available), this technical company has quite a few means to (purposely) frustrate modifications of their products. Sadly this may disqualify their product for proper firewalls.
