Re: Passive OS fingerprinting.

[Evgeniy Polyakov <johnpol@2ka.mipt.ru>]

On Tue, Jul 01, 2008 at 04:16:28PM +0200, Patrick McHardy (kaber@trash.net) wrote:
> I truely hope it will be since I'm working (slowly, as time permits)
> on the *tables successor that will implement things like this in
> userspace. Every module we add that adds more complicated logic in
> the kernel will make adding an iptables compat layer harder.

It still is very tempting to implement such things as iptables modules.
For example I consider to create tunnel-like device and iptables target
to implement ip-over-dns tunnel, and I need iptables extension since I
only control single machine outside of my ISP which is not firewalled.
Having new way of writing iptables extensions requires to update
existing machines, which is not possible frequently
(like existing enterprise (r) (c) (tm) solutions...)

> I'd CC the netfilter user list, its likely you'll find some voices
> in favour there :)

:)

> >>Yes, but I don't want to add another interface netfilter userspace
> >>has to know about. It should either use nfnetlink and remove the proc
> >>interface, or remove the connector interface and use proc.
> >>Preferrably the former.
> >>    
> >
> >It uses proc to load rules - I do not like it either, but it was the
> >simplest way to do so :)
> 
> We can rethink that part if it will actually get merged.

Sure.

-- 
	Evgeniy Polyakov