Re: priv_data patch

[Patrick McHardy <kaber@trash.net>]

Joakim Axelsson wrote:
> 2006-08-14 16:48:27+0200, Patrick McHardy <kaber@trash.net> ->
> 
>>Its actually quite clear what is needed. We want a userspace interface
>>built on netlink, that acts on individual rules, not entire rulesets.
>>There are a few more ideas, like handling negation centrally, allowing
>>userspace to specify whether a target is terminal or not, allow multiple
>>non-terminal targets in a row, etc, but nothing really fundamental.
>>
> 
> 
> I have suggested this some years ago. But a new module type "action" could be
> used, along with "match" and "target". Meaning:
> 1. After zero, one or more matches
> 2. You run a zero, one or more actions
> 3. And finally end up in zero or one target.
> 
> Example:
> iptables -m condition -m limit -a LOG -j DROP 
> 
> This means that the only targets we have today (as i can remember now) are:
> -j ACCEPT
> -j DROP
> -j REJECT
> -j other_chain


Yes, we clearly want something like that. The exact details need to be
worked out when actually implementing it.