jamal wrote:
BTW, is there any reason the SPD couldnt have been implemented from day
one using netfilter classification ? Why did we need another speacilized
classifier? the actions are clearly implementable as targets.
IMO iptables isn't so great that one would actually want to do this.
The entire ruleset needs to be one continous area in memory, so it can
not be changed, only replaced. To make it useable over pfkey would mean
many things that are currently done by iptables in userspace need to be
done in the kernel. There are multiple other reasons, but I don't think
its even worth discussing this. This of course doesn't mean I'm against
reducing the number of different classification engines.
Regards
Patrick
|