question on extern exec prog with iptables.

question on extern exec prog with iptables.

[sebastien]

Hi all,

I have a web server which send "wrong" html to the client and I would
like to be able to correct this "wrong" html by reforming packets and
send them an the network.

The problem is that iptables or ip6tables won't be natively able to send
me the original destination client's address and port of server's
answer : am I wrong ? iptables and ip6tables will form a new address and
port destination and that'all.

If so, I need a way to send the exact port of the original packet to the
corrective program : the one which will desserve transparently the
client called by ? ... iptables or ip6tables.



Legacy, with "wrong" html :

----------          --------------
+ Client +   <--->  + Web Server +
----------          --------------


Result, hopefully wanted, after transformation :

----------      --------------     ----------------------     ----------
+ Client + -->  + Web Server + --> + corrective program + --> + Client +
----------      --------------     ----------------------     ----------


As you can see, I have no way to see packet from Client to Server. I
suppose that the only "strange" packet from Client is a change port
asking which the server answer (tcp option). Corrective program will not
touch thoses packets : it simply "re-arrange" packet at application
level to the client and deliver it to the good port (the one of the
server originaly send to).

Does iptables and ip6tables modules can do this ? Call a extern program
with the full packet content of the server.

Thanks by advance, best regards.
See ya.
Sébastien

Nota : one can notice iptables and ip6tables mention. The production
server is on Ipv4 and I only can reproduce an Ipv6 laboratory. So, I
need a way to make the job with both protocols.

Re: question on extern exec prog with iptables.

[Grant Taylor]

On 11/15/2008 12:38 AM, sebastien wrote:
> The problem is that iptables or ip6tables won't be natively able to 
> send me the original destination client's address and port of 
> server's answer : am I wrong ? iptables and ip6tables will form a new 
> address and port destination and that'all.

Why not?  (See below.)

> If so, I need a way to send the exact port of the original packet to 
> the corrective program : the one which will desserve transparently 
> the client called by ? ... iptables or ip6tables.

I think you will probably be best served by (I believe) the QUEUE target 
that allows IPTables to pass complete packets to user space for processing.

> Does iptables and ip6tables modules can do this ? Call a extern 
> program with the full packet content of the server.

I think if you use the QUEUE target you will be able to pass packets 
(which ever ones you want) to your ""correction program, including all 
source / destination IP and port information.  With this information you 
should be able to process the packets as you see fit and then generate a 
new reply packet.



Grant. . . .