Re: Developing a user space library for filtering

[Philip Craig <philipc@snapgear.com>]

Darren.Reed@Sun.COM wrote:
> Henrik Nordstrom wrote:
>> Having an API which says things like "Add a rule to accept this kind of
>> traffic" is only possible cross the different firewall implementations
>> if there also is a defined firewall ruleset structure requirement
>> defining suitable places in the ruleset where this API can make it's
>> modifications.
>>  
>>
> 
> Which means that coming up with a design that works won't
> necessarily be a slam-dunk.

It means the API must an interface to a firewall policy, not to a kernel
mechanism.  For example, the API should enable you to tell shorewall
that you want to accept something, rather than directly generating
an iptables rule.  (Although a simple implementation for the case where
you have no firewall policy may directly generate an iptables rule.)