[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter
Subject:    Re: nftables: introspection capabilities?
From:       Pablo Neira Ayuso <pablo () netfilter ! org>
Date:       2011-05-26 17:33:45
Message-ID: 4DDE8EF9.8090208 () netfilter ! org
[Download RAW message or body]

On 24/05/11 11:14, gapsf@yandex.ru wrote:
>>> There is no doubt that for nftables frontends will be written too, so the question is:
>>> "Will nfatbles be able to find out various information
>>> about their own current state: tables, chains, rules, etc?"
> 
> JE> You can already obtain this information by using libiptc, iterating over 
> JE> all rules and testing for a particular src/dst address (very much like 
> JE> poor man's `grep -s 1.2.3.4\b` on the text output).
> According to Wikipedia "libiptc ... shouldn't be used as a public API,
> and is known to change, which breaks programs that use it"
> and libiptc is a 3d party project - not netfilter.org's and outdated, isn't it?
> 
> As for nftables: means native capabilities of it's kernelspace code (aka virtual machine).

just to clarify, that's not a virtual machine but a pseudo-state machine
in the BPF fashion, OK?
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]