Re: [LARTC] Layer-7 =?iso-8859-1?q?Filter

Re: [LARTC] Layer-7 =?iso-8859-1?q?Filter

[Ricardo Jorge da Fonseca Marques Ferreira]

?Date: Sat, 31 May 2003 17:40:53 +0100
User-Agent: KMail/1.5.9
References: <3EBFD82E.2060102@mathcs.carleton.edu> <200305311735.04126.stef.coene@docum.org>
In-Reply-To: <200305311735.04126.stef.coene@docum.org>
X-KMail-Link-Message: 443491
X-KMail-Link-Type: reply
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <200305311740.54328.stormlabs@gmx.net>
Status: RO
X-Status: Q
X-KMail-EncryptionState:  
X-KMail-SignatureState:  
X-KMail-MDN-Sent:  

On Saturday 31 May 2003 16:35, Stef Coene wrote:
> Hi,
>
> Layer 7 filtering was a topic on slashdot !
> http://slashdot.org/article.pl?sid\x03/05/30/180224&mode=thread&tid\x106&tid>185
>
> After reading some slashdot comments, I downloaded the source.  And I have
> some comments on it.  I think these comments also belongs to the faq page
> of the layer 7 filtering page.
>
> First of all, this is not a packet filter, it's a connection filter.  So
> once a connection is classified as http, all following packets beloning to
> that connection are classified as http.  I just wonder if it also works for
> ftp traffic with seperate command and data connections.

Which was exactly what i wanted, but then i opened the page and saw its only 
for 2.5 kernels. I'm not about to put a 2.5 kernel in my router.

I doubt it works for protocols like FTP as it uses regular expressions to 
identify the protocol much like a virus program. The data connection of FTP 
might not have any identifying data...

A good way of doing that would be a plugin system, in which such plugins could 
interpret the protocol.

Maybe some kind soul will backport it to 2.4 so i can test it :)
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Layer-7 =?iso-8859-1?q?Filter

[Stef Coene]

On Saturday 31 May 2003 18:40, Ricardo Jorge da Fonseca Marques Ferreira 
wrote:
> On Saturday 31 May 2003 16:35, Stef Coene wrote:
> > Hi,
> >
> > Layer 7 filtering was a topic on slashdot !
> > http://slashdot.org/article.pl?sid\x03/05/30/180224&mode=thread&tid\x106&ti
> >d= 185
> >
> > After reading some slashdot comments, I downloaded the source.  And I
> > have some comments on it.  I think these comments also belongs to the faq
> > page of the layer 7 filtering page.
> >
> > First of all, this is not a packet filter, it's a connection filter.  So
> > once a connection is classified as http, all following packets beloning
> > to that connection are classified as http.  I just wonder if it also
> > works for ftp traffic with seperate command and data connections.
>
> Which was exactly what i wanted, but then i opened the page and saw its
> only for 2.5 kernels. I'm not about to put a 2.5 kernel in my router.
>
> I doubt it works for protocols like FTP as it uses regular expressions to
> identify the protocol much like a virus program. The data connection of FTP
> might not have any identifying data...
Ftp can be marked with iptables and the conntrack ftp-helper.  But I wonder 
why they didn't extended iptables so you can mark the packets and use that 
mark with the fw filter.  If iptables is smart enough to recognise the 
packets, you can also drop the packets to deny certain traffic.

> A good way of doing that would be a plugin system, in which such plugins
> could interpret the protocol.
>
> Maybe some kind soul will backport it to 2.4 so i can test it :)
Same for me.  Or a port to iptables.

Stef

-- 

stef.coene@docum.org
 "Using Linux as bandwidth manager"
     http://www.docum.org/
     #lartc @ irc.oftc.net

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/