Re: [RFC 0/4] nfnetlink_queue bypass queue to userspace X bytes of connection

[Karl Hiramoto <karl@hiramoto.org>]

 On 07/24/2010 08:26 PM, Pablo Neira Ayuso wrote:
> On 24/07/10 17:44, Karl Hiramoto wrote:
>> Hi, I'm working on a nf_queue based HTTP filter. Sometimes I want to
>> NF_ACCEPT X bytes of a connection. In a HTTP connection its part of the
>> Content-Length.  Being able to directly NF_ACCEPT large parts of a connection
>> is a 2X to 3X speedup, by not queuing these packets to user-space.
> I think that you could avoid this extensions by means of conntrack marks
> and the string match. Could you elaborate your application, please?
I thought about that before i made the extension but there's no way, to do it reliably and avoid race conditions.  string matches are also really inefficient, with string matches every packet with a certain mark would be scanned, but its not necessary since in HTTP because you know which part of the message you want to scan, but it changes on every request/response.

It's  a HTTP 1.1 filter, so it has to support persistent connections, multiple requests per connection.  There is the possibility that some requests are allowed and others are not.   Using connmark its posible to allow an entire connection to NF_ACCEPT bypassing the queue, however not really possible when there are multiple requests per connection.

Some of the features of my app are:
* Filter Accept/block  by URL, or HTTP "Host:" tag
* Log all request/responses,   URL, content length, time duration of request / response.
* Parts of a HTTP 1.1 persistent connection can be rejected, other parts accepted.


--
Karl Hiramoto