I have been looking into how kernel supplies userspace with what is
happening inside kernel via NETLINK socket and how udevd->hald->dbus->user
benefits from it.
(NETLINK_ROUTE protocol reports for example interface up/down events
and KOBJECT report device add/remove && insmod/rmmod events)
I was wondering is there a way to monitor iptables (xtables)
replace_table/(un)register_target/... events somehow.
(could not see it in kernel code but that doesn't mean it's not there.
NETLINK_FIREWALL seems to be about queuing packets to userspace)
Main incentive for me is that it would be better to listen for a socket
than
poll for firewall changes manually.
If such does not exist would there be intrest to add such capability.
I could volunteer to do bit of design/implementation if such feature
would be welcomed.
--
Janne (orshouldthisgotonetfilter-devel) Pänkälä
