From mboxrd@z Thu Jan 1 00:00:00 1970 From: Changli Gao Subject: RFC: netfilter: synproxy iptables target Date: Thu, 20 May 2010 17:46:06 +0800 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: Netfilter Developer Mailing List , Linux Netdev List To: Patrick McHardy Return-path: Received: from mail-pw0-f46.google.com ([209.85.160.46]:45742 "EHLO mail-pw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752165Ab0ETJq0 convert rfc822-to-8bit (ORCPT ); Thu, 20 May 2010 05:46:26 -0400 Sender: netfilter-devel-owner@vger.kernel.org List-ID: I have implemented a simple SYNPROXY iptables target. It is much like the SYNPROXY implementation in pf of OpenBSD, but won't have state until the first connection is established with the help of syncookies. The code is hosted at github: http://github.com/xiaosuo/xiaosuo/tree/master/synproxy/ Currently, it can work with firewall and local socket. It is in the very early stage, and ugly. And I will add --timeout parameter to this target as TCP_DFER_ACCEPT, so I can do NAT basing on the request data. i.e. iptables -t nat -A OUTPUT -p tcp -m synproxy --http-url "*.jpg" -j DNAT --to-destination $image_http_server:80 And is there any chance to merge it into mainline? --=20 Regards=EF=BC=8C Changli Gao(xiaosuo@gmail.com) -- To unsubscribe from this list: send the line "unsubscribe netfilter-dev= el" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html