Messages in this thread | | | Date | Tue, 19 Dec 2006 14:07:17 +0100 (MET) | From | Jan Engelhardt <> | Subject | Re: [PATCH] xt_request_find_match |
| |
On Dec 19 2006 12:51, Patrick McHardy wrote: >> Reusing code is a good idea, and I would like to do so from my >> match modules. netfilter already provides a xt_request_find_target() but >> an xt_request_find_match() does not yet exist. This patch adds it. > >Why does your match module needs to lookup other matches?
To use them?
I did not want to write
some_xt_target() { if(skb->nh.iph->protocol == IPPROTO_TCP) do_this(); else do_that(); }
since the xt_tcpudp module provides far more checks than just the protocol (TCP/UDP), like
/* To quote Alan:
Don't allow a fragment of TCP 8 bytes in. Nobody normal causes this. Its a cracker trying to break in by doing a flag overwrite to pass the direction checks. */
(see xt_tcpudp.c)
-`J' -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |