Re: [PATCH] xt_request_find_match

From: Jan Engelhardt
Date: Tue Dec 19 2006 - 08:11:55 EST



On Dec 19 2006 12:51, Patrick McHardy wrote:
>> Reusing code is a good idea, and I would like to do so from my
>> match modules. netfilter already provides a xt_request_find_target() but
>> an xt_request_find_match() does not yet exist. This patch adds it.
>
>Why does your match module needs to lookup other matches?

To use them?

I did not want to write


some_xt_target() {
if(skb->nh.iph->protocol == IPPROTO_TCP)
do_this();
else
do_that();
}

since the xt_tcpudp module provides far more checks than just the protocol
(TCP/UDP), like

/* To quote Alan:

Don't allow a fragment of TCP 8 bytes in. Nobody normal
causes this. Its a cracker trying to break in by doing a
flag overwrite to pass the direction checks.
*/

(see xt_tcpudp.c)



-`J'
--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/