Checking add/remove rules

Checking add/remove rules

[Silimite]

Is there any reliable way to tell when a rule is added or removed from
within an iptables module?

I know you can see when they are added and removed in the check() and
destroy() functions but it seems those are called multiple times and
there does not appear to be a way to determine exactly when a rule is
being added or removed.

Thanks for any information!

Re: Checking add/remove rules

[Silimite]

Should I take this silence as meaning this is not possible?  Or maybe
no one knows?

Even a "that's not possible" answer would be nice.

Thanks

S

On 8/22/05, Silimite <silimite@gmail.com> wrote:
> Is there any reliable way to tell when a rule is added or removed from
> within an iptables module?
> 
> I know you can see when they are added and removed in the check() and
> destroy() functions but it seems those are called multiple times and
> there does not appear to be a way to determine exactly when a rule is
> being added or removed.
> 
> Thanks for any information!
>

Re: Checking add/remove rules

[Martin Josefsson]

On Wed, 24 Aug 2005, Silimite wrote:

> Should I take this silence as meaning this is not possible?  Or maybe
> no one knows?
>
> Even a "that's not possible" answer would be nice.

It is possible, it's ugly but possible.

Look at the geoip match in patch-o-matic-ng, more exactly the refcounting
in the checkentry()/destroy() functions in ipt_geoip.c And look at the
posision of the refcount member of the ipt_geoip_info struct in the
includefile. And look at the size and userspacesize members of struct
iptables_match in libipt_geoip.c

I hope that helps.

/Martin

Re: Checking add/remove rules

[Silimite]

Thanks!  That's what I needed to know.  I was mostly just wondering if
there was a way besides something like ref-counting.  Since there does
not seem to be another way I now know what to do.

Thanks again.

S

On 8/25/05, Martin Josefsson <gandalf@wlug.westbo.se> wrote:
> Look at the geoip match in patch-o-matic-ng, more exactly the refcounting
> in the checkentry()/destroy() functions in ipt_geoip.c And look at the
> posision of the refcount member of the ipt_geoip_info struct in the
> includefile. And look at the size and userspacesize members of struct
> iptables_match in libipt_geoip.c
> 
> I hope that helps.
> 
> /Martin