Re: Developing a user space library for filtering

[Darren.Reed@Sun.COM]

Henrik Nordstrom wrote:

>tis 2007-05-22 klockan 14:14 -0700 skrev Phil Dibowitz:
>
>  
>
>>Darren, you're correct, this is definitely needed. If IPF and IPtables and
>>everyone else all used a common core kernel-userspace API, with a standard
>>library on top of it, that would be awesome.
>>    
>>
>
>As things is today I am not sure how this would work in a general sense
>for what is proposed. The way you structure rules is quite different in
>the different firewall implementations.
>
>But sure, for things like connection tracking and related events it's
>surely doable. Also, writing a generic firewall ruleset "compiler" which
>can translate to ipf, iptables and a few others is doable, but the
>actual installed ruleset will need to be somewhat different in both
>structure and syntax in the different implementations, not only syntax.
>
>Having an API which says things like "Add a rule to accept this kind of
>traffic" is only possible cross the different firewall implementations
>if there also is a defined firewall ruleset structure requirement
>defining suitable places in the ruleset where this API can make it's
>modifications.
>  
>

Which means that coming up with a design that works won't
necessarily be a slam-dunk.

Darren