Packaging optional netfilter modules
Michael Schwendt
fedora at wir-sind-cool.org
Sun Sep 12 21:05:37 UTC 2004
On Sun, 12 Sep 2004 13:33:41 -0700, Kenneth Porter wrote:
> I wanted to try the experimental TARPIT module from netfilter, and because
> it's experimental, neither the upstream kernel team nor Red Hat will
> incorporate this into the stock kernel. This is of course perfectly
> reasonable.
>
> But since netfilter modules are kernel modules, it seems like it should be
> straightforward to package them as free-standing packages. Has anyone tried
> to do this? What success have you had?
>
> Another factor is that the kernel module will need matching machinery in
> the iptables userspace program to select the module and parse its options.
> (eg. for TARPIT, it would parse the "-j TARPIT" command.) I believe
> currently this requires a recompile of the utility. Has any work been done
> to make this more modular, with runtime selection of additional parsing
> routines? That would allow the userspace parsing piece to be supplied in
> the kernel module package to be dropped in a suitable directory for use at
> runtime.
Last time I looked at it, the iptables userspace tarball used hidden
scripts to examine the kernel source code tree for what's available.
That was with kernel 2.4.x and FC1, though.
--
Fedora Core release 2 (Tettnang) - Linux 2.6.8-1.521
loadavg: 1.38 1.19 1.07
More information about the fedora-devel-list
mailing list