Re: new code; iptables-xml for iptables package.

[Glen Turner <glen.turner@aarnet.edu.au>]

Amin Azez wrote:

> A sample of the xml format
> <iptables-rules>
>   <table name="mangle" >
>     <chain name="PREROUTING" policy="ACCEPT" packet-count="63436"
> byte-count="7137573" >
>       <rule >
>        <conditions>
>         <match >
>           <p >tcp</p>
>         </match>
>         <tcp >
>           <sport >8443</sport>
>         </tcp>
>        </conditions>
>        <actions>
>         <call >
>           <check_ip />
>         </call>
>        </actions>
>       </rule>
>     </chain>
> </iptables-rules>

Folks,

Before committing stuff which generates XML output it might be
worthwhile checking if a DTD has also been supplied so that
third-party tools can use and generate the XML with some
assurance.  If the use of the XML is private to Netfilter
then then XML format offers no advantages over the standard
format.

In particular, folks will want something to use as a target
when converting to/from Tivoli XML/Juniper XML/Cisco XML/
OASIS XACML/IETF PCM (as you can see there's no shortage of
XML ACL formats, and still no real standardisation in sight
despite consistent ACLs between devices being a boon to network
operations).

Thanks, Glen

-- 
  Glen Turner         Tel: (08) 8303 3936 or +61 8 8303 3936
  Australia's Academic & Research Network  www.aarnet.edu.au