Re: [PATCH] xt_request_find_match

[Jan Engelhardt <jengelh@linux01.gwdg.de>]

On Dec 19 2006 12:51, Patrick McHardy wrote:
>> Reusing code is a good idea, and I would like to do so from my 
>> match modules. netfilter already provides a xt_request_find_target() but 
>> an xt_request_find_match() does not yet exist. This patch adds it.
>
>Why does your match module needs to lookup other matches?

To use them?

I did not want to write


some_xt_target() {
    if(skb->nh.iph->protocol == IPPROTO_TCP)
        do_this();
    else
        do_that();
}

since the xt_tcpudp module provides far more checks than just the protocol
(TCP/UDP), like

    /* To quote Alan:

       Don't allow a fragment of TCP 8 bytes in. Nobody normal
       causes this. Its a cracker trying to break in by doing a
       flag overwrite to pass the direction checks.
    */

(see xt_tcpudp.c)



	-`J'
-- 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/