Re: Forking inside netfilter queue

[Rayed Alrashed <rayed@saudi.net.sa>]

> Unless there are a real lot of these addresses that are permitted, and 
> they change rapidly, then I'd expect it would be a better design to 
> get all the valid URIs from the MySQL query on init and store them in 
> a linked list.
I am afraid this not an option, because my final goal is to integrate my 
application with external vendor database using the vendor own API.


> Also, people already do this type of thing with an HTTP proxy like 
> squid before the HTTPd.

I've tested HTTP proxy before, but the overhead is very big, and I 
couldn't get the proxy to handle high loads.

Another problem with proxy servers is using the proxy own IP for 
outgoing request, unfortunately using the same IP for many requests 
trigger many IDSes to block the proxy IP.

What I am trying to do is a light weight HTTP filter, by searching for 
HTTP requests in packet traveling on the wire, with minimal TCP 
reassembly to find HTTP requests spanning more than one packet.