Re: [HELP] why the string match does not work in nat tables?

[Pablo Neira Ayuso <pablo@netfilter.org>]

On 01/02/11 13:35, Jan Engelhardt wrote:
> On Tuesday 2011-02-01 13:32, Pablo Neira Ayuso wrote:
> 
>> On 01/02/11 13:01, Gáspár Lajos wrote:
>>> The string match is much like a toy and not a real help in the iptables.
>>> (Sorry, I do not really "believe" in this match. But also I understand
>>> the need for such match. Sometimes it can be very usefull.)  As already
>>> mentioned before, the main problem is the fragmentation.
>>
>> fragmentation is not a problem for algorithms like knuth-pratt-morris,
>> which is implemented in textsearch. boyer-moore is faster but if the
>> text is splitted among fragments, it won't find a matching.
>>
>> segmentation is a problem for textsearch, it wouldn't be hard to extend
>> the string matching to make it flow-based.
> 
> How so? You would have to collect the packets like l7-filter.

You can store the partial matching in the ts_state structure, which
would be stored in every ct flow object, with a conntrack extension.
You'll have to make the string match stateful, of course.

BTW, I'm working on something new to provide a replacement l7-filter.