Re: patch: policy update by id

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Wed, Apr 27, 2005 at 07:43:56PM -0700, David S. Miller wrote:
> 
> I'm willing to reneg on that position if you can convince me
> that security minded folks won't be surprised by this pseudo-
> aliasing.  For example, do firewall systems tend to support
> such priority schemes?  If so, I guess we can do it.

Well netfilter certainly follows this scheme:

$ iptables -I INPUT -s 3.3.3.3 -d 4.4.4.4 -j ACCEPT
$ iptables -I INPUT -s 3.3.3.3 -d 4.4.4.4 -j ACCEPT
$ iptables -v -L INPUT -n
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 ACCEPT     all  --  *      *       3.3.3.3              4.4.4.4     
    0     0 ACCEPT     all  --  *      *       3.3.3.3              4.4.4.4     

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt