tansly / simplepf Goto Github PK

Add a mechanism to remove a specific rule from a chain.

May idenfity rules with an integer id, but how does the user know which rule is which? Of course by consulting the rule list that we dump in proc, see #7.

Define a grammar for commands.
Parse the command, fill a command struct and write it to /proc/simplepf/rules.

Document:

• Kernel/user API
• Usage of userspace helper
• Build instructions; especially dependencies of userspace helper such as Boost program options

A few printks won't hurt noone.

Default accept policy does not always make sense. Give an option to set the default policy.

However, default deny policy would be too strict for this kind of a packet filter. Without an option to allow a range of ports etc. it will be simply unusable.

For more practical configuration, and for a default deny policy to be even marginally practical (#10), there needs to be a way to match a range of ports, IP addresses etc.

Don't let user set port numbers for ICMP filters or ICMP types for UDP/TCP filters.

Without this sanitization, nothing will break; the fields will just be ignored. But we can at least warn the user.

Need an option to apply rules to specific interfaces.