Subject: Re: [22/*] [NETFILTER] Use correct IPsec MTU in TCPMSS

From: Patrick McHardy <[email-masked]>
Date: Sun, 20 Mar 2005 20:10:52 +0100

jamal wrote:
> BTW, is there any reason the SPD couldnt have been implemented from day
> one using netfilter classification ? Why did we need another speacilized
> classifier? the actions are clearly implementable as targets.

IMO iptables isn't so great that one would actually want to do this.
The entire ruleset needs to be one continous area in memory, so it can
not be changed, only replaced. To make it useable over pfkey would mean
many things that are currently done by iptables in userspace need to be
done in the kernel. There are multiple other reasons, but I don't think
its even worth discussing this. This of course doesn't mean I'm against
reducing the number of different classification engines.

Regards
Patrick