Statefull SOCKS filter

[Peter Christensen <pch@coolsystems.dk>]

Hi,

I'm currently in the development of a transparent firewall bridge, whose 
sole purpose is to filter our everything but LAN traffic and traffic for 
a list of privileged servers on the Internet. Since it is meant to work 
on an bunch of different network configurations out-of-box, it must be 
able to detect and filter proxy traffic as well.

My problem is specifically with making a SOCKS filter. I've done it in 
user-space with great success (basically a state machine), but I 
naturally want this to be done in iptables. And here is the real question:

Are the any preferred "smart" way of doing this kind of statefull 
filters, where some upper software layer handles the actual connection 
for me, if you follow me? At first I thought connection tracking was the 
way to go, but apparently this is primarily for temporarily accepting a 
given connection based on the content of another connection.
I CAN solve the whole thing just by making a basic match filter, having 
my own array of current connections with their appropriate SOCKS state 
(This is basically what my user-space equivalent does), but I think that 
it is quite a lot of work, especially if a similar thing is already done 
elsewhere in the kernel. After all, the bridge does not have a 
tremendous amount of processing power!

I apologize if I'm just too uninformed, but I've so far failed to find 
any documentation of how to make an actual statefull filter, whose 
purpose was NOT to help out NAT etc.

-- 
Best regards

Peter Christensen

Developer
------------------
Cool Systems ApS

Tel: +45 2888 1600
  @ : pch@coolsystems.dk
www: www.coolsystems.dk