Re: netfilter modules

David Hollis
Wed, 08 Sep 2004 18:33:21 -0000

On Wed, 2004-09-08 at 17:13 +0200, Claus Rosenberger
wrote:
> > I don''t think so. Integrating support for a new netfilter
module often
> > requires rather sugrical changes to the code. The ''policy
match'' changes
> > to support Kernel 2.6 native IPSEC is a good example.
>
> hmm, i understand that it doesn''t make sense to include code for
> patch-o-matic modules because nobody know what will be changed in the
> future. how long patch-o-matic modules are seperated before being included
> into the kernel tree? i want to use h323 and in future ct_sync. any other
> ideas how it is possible to integrate these things without breaking the
> core shorewall code?
>

I don''t think either of those would require any direct shorewall
support.  ct-sync would need a rule permitting the traffic (at most),
and h323 would just need to be added to the modules list.  If there were
any specific tweaks for h323, that could be handled via extension
scripts.

--
David Hollis <dhollis@davehollis.com>