Re: condition and 2.6

["Gerd v. Egidy" <lists@egidy.de>]

> This comment is meant as:
>
> "Since nobody provided us with a 2.6.x port yet, and I have very limited
> time for such porting, and I personnaly dislike the condition match
> anyway, I marked it as 2.4.x only - since the 2.4.x patch doesn't work
> for 2.6.x"

Thank you for the clarification.

> > What do you dislike? Is it the idea or the implementation? Do you know of
> > any bugs or possible problems in the code - especially with 2.6?
>
> The idea of having /proc files control how the ruleset behaves.  This is
> an ugly kludge for our less-than-optimal ruleset change performance.
> Apart from that I cannot really see why this has to be solved in the
> kernel and not by some userspace daemon that updates the ruleset
> whenever a change is needed.

I don't mind that much about ruleset change speed. The different conditions 
for my firewall are changed by different scripts and I can't make sure that 
only one is running at a time. So I fear a race like this:

Program 1: iptc_init
Program 2: iptc_init
Program 1: modify rule A
Program 2: modify rule B
Program 1: iptc_commit
Program 2: iptc_commit

As far as I understand the libiptc code, the result will be that the changes 
done by program 1 will be lost. Is that correct or have I misunderstood the 
code?

The condition module offers a lot more atomicity and I can be sure that two 
scripts don't interfere with each other.

Kind regards,

Gerd