Re: netfilter modules

Tom Eastep
Wed, 08 Sep 2004 16:03:03 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Claus Rosenberger wrote:
|>I don''t think so. Integrating support for a new netfilter module
often
|>requires rather sugrical changes to the code. The ''policy
match'' changes
|>to support Kernel 2.6 native IPSEC is a good example.
|
|
| hmm, i understand that it doesn''t make sense to include code for
| patch-o-matic modules because nobody know what will be changed in the
| future. how long patch-o-matic modules are seperated before being included
| into the kernel tree?

There seem to be no rules. Some of them seem to stay there indefinitely.

i want to use h323

Two things:

a) That is a module that will probably *never* be included in the
kernel.org tree. The author of the module admits it is a miserable hack
that doesn''t do the complete job.

b) You should be able to use the H323 module with *no* change to Shorewall.

~ and in future ct_sync.

I wouldn''t think that ct_sync would need any Shorewall support either.

any other
| ideas how it is possible to integrate these things without breaking the
| core shorewall code?

Again, if you need to add netfilter rules that are not possible using
standard Shorewall file entries, then I would start with trying to do
what you need to in Extension Scripts; that is the architected way for
users to extend Shorewall safely.

- -Tom
- --
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBPy03O/MAbZfjDLIRAqYSAJsGQNzXJYYuNZuFpRkW1nE+xp9CLQCfQrS1
3avlVIKmwus/EL9PWK5EdEE=cjMz
-----END PGP SIGNATURE-----