> Sounds easy -- I assume that the --type values are all upper case? I'll work > up a patch against 4.4.20-Beta2 if you would be willing to test it. > Good question! I haven't actually tried lowercase even though the c source tells me that it is actually "drop" (and so does the man page).... Just quickly tested it - the value of the "--test" parameter is not case sensitive, but accepts only "drop", "reject" or "accept" as values, naturally!
It is also worth noting that "mixing" of type and action should not be allowed (this is something shorewall internally needs to resolve), i.e. -N ADROP -A ADROP -j AUDIT --type accept -A ADROP -j DROP should not be allowed - the action (DROP) should match the AUDIT "--type" value (accept). It would be nice if you could distinguish between the various jump targets, in other words - "DROP" is "standard" drop, but you could call the new audit drop ADROP for example. Similar with ACCEPT (which logs all ACCEPTed matches) and REJECT targets. I am more than willing to test this and give you a hand if needed, not least because if I manage to implement this feature throughout my entire audispd/auditd system I will be saving myself a *lot* of hassle - the main reason why I am so eager and can't afford to wait until the .39 kernel comes out. ------------------------------------------------------------------------------ What Every C/C++ and Fortran developer Should Know! Read this article and learn how Intel has extended the reach of its next-generation tools to help Windows* and Linux* C/C++ and Fortran developers boost performance applications - including clusters. http://p.sf.net/sfu/intel-dev2devmay _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
