iptables http problems

iptables http problems

[Paolo Cerrito]

Hi, i'm writing a userspace application, using nfnetlink_queue. Can i  
write a rule for iptables that send on a queue http packets? the problem  
is that i have to distinguish the packets for apllication layer protocols.  
Is there a way for that?

-- 
Creato con il rivoluzionario client e-mail di Opera:  
http://www.opera.com/mail/

Re: iptables http problems

[David Vogt]

2006/4/27, Paolo Cerrito <paolo.cerrito@tin.it>:
> Hi, i'm writing a userspace application, using nfnetlink_queue. Can i
> write a rule for iptables that send on a queue http packets? the problem
> is that i have to distinguish the packets for apllication layer protocols.
> Is there a way for that?

I am not sure if I understand correctly. Something like this?

$IPTABLES -t mangle -INPUT -p TCP --sport 80 -j NFQUEUE --queue-num 1

David

Re: iptables http problems

[Amin Azez]

Paolo Cerrito wrote:
> Hi, i'm writing a userspace application, using nfnetlink_queue. Can i
> write a rule for iptables that send on a queue http packets? the problem
> is that i have to distinguish the packets for apllication layer
> protocols. Is there a way for that?

You could look at: http://l7-filter.sourceforge.net/
Which is an iptables module that recognizes application layer protocols.

Be aware that it is hard to do reliable patterns for some applications,
and also that in order to recognize a layer 7 application iptables must
be monitoring the connection when it starts.

Any connections already active before the rule is active might not be
recognized.

Further realize, that it takes a few packets sometimes to gather enough
data to recognize the application layer protocol, especially if someone
is trying to hide their traffic by using very very small packets, and so
you may not recognize the application layer on the first packet, so you
may not be able to use this for totally blocking data based on
application layer as some packets may get through before classification
is complete.

Sam