On Wed, Jul 23, 2008 at 4:21 PM, Patrick McHardy wrote: >>> - ipp2p - last version I've seen was a *horrible* mess, unless I'm >>> confusing it with the other l7 classifier module out there. >> >> It was ugly from a codingstyle pov, which was fixed. It inspects >> packets >> xt_ipp2p I gave it some care and a cleanup. it also "works", that is, it >> matches on bittorrent (something I could test), not all (data) connections >> though, but I guess the control connections are in. > > Just send it to netfilter-devel. If its the thing with lots > of hard-coded binary matches full of magic values I'm not > interested :) I'd be more interested in a discussion what > would be necessary to represent all those matches through > the FSM textsearch match or something similar. ipp2p is the one with hard coded magic values. What are your feelings on the kernel version of l7filter (regex patterns loaded from the filesystem)? Currently it requires a patch to add a structure to nf_conn, but I've been meaning to rewrite it to use ct_extend so that it could at least be included into xtables-addon and used with a stock kernel, although if there's interest in having it merged into mainline I'd be willing to focus on that. One thing I'm not sure of is whether the license used by the Henry Spencer regex library it depends on is acceptable by kernel standards (or whether it's permissive enough to relicense under GPL, as IANAL). -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
