Re: Developing a user space library for filtering

[Darren.Reed@Sun.COM]

Carl-Daniel Hailfinger wrote:

>Hi Darren,
>
>On 22.05.2007 00:27, Darren.Reed@Sun.COM wrote:
>  
>
>>One of the core problems I see as people want to more and
>>more with firewall/NAT technology is integrate using it into
>>their application (whatever that may be.)  As time goes by,
>>this problem is becoming more and more acute and perhaps
>>is doing us (those who develop said technologies) a disservice
>>by making the "barrier to entry" too high.
>>    
>>
>
>Sorry if I'm being dense. Do you want to target firewall frontends
>or applications which have the desire to punch holes into the
>firewall?
>  
>

Neither.  Applications that sit on top of firewall software.

As an example, using squid on your Linux firewall/router in
transparent proxying mode requires that squid has some code
in it that knows how to talk to Linux in order to discover the
original destination and change the outgoing connection
such that the original address is used again.  Doing that
requires specific knowledge of the API that netfilter/iptables
uses.

Another example might be IDS software running on your Linux
firewall/router.  If that detects an attack, it should be able to
talk to netfilter/iptables and do "something" to mitigate it.

In both cases I'd like to see something developed such that
the 3rd party applications don't need to know what NAT or
firewall technology is being used.

Darren