[PATCH] l7-filter for pom
Thu Aug 19 11:44:43 CEST 2004
Content-Type: text/plain; charset=us-ascii
On Sun, Aug 15, 2004 at 07:51:16PM -0500, Matthew Strait wrote:
> Here is the l7-filter match from http://l7-filter.sf.net as a patch to=20
> patch-o-matic. It adds the ability to match on regular expressions in th=
> application layer data of connections.
> (I'm submitting this in what appears to be the prefered manner, but if=20
> another format would be preferable, let me know.)
No, this format is just fine.
First of all, I am not really a friend of the idea of layer7 filtering.
(not your implementation, but the idea of doing this in the kernel)
Anyway, there is a need for it, and we need to deal with this need.
I will integrate your patch, if you consider the following recommendations:
- You don't deal with nonlinear skb's at all. You cannot make the
assumption that the packet payload is linear in memory. The options
you have is=20
1) skb_linearize (which linearizes the whole skb and sucks)
2) implement nonlinear-aware pattern matching using skb_iter()
3) wait for me until I have finished my skb_iter() based generic
in-kernel pattern matchig API (baed on qsearch).
I suggest you go for '1' until '3' shows up.
- Don't have printk() in per-packet codepath without net_ratelimit() or
you will be DoS'ed
- The number of packets for each direction is now accounted for if you
use the conntrack-acct patch (will show up in 2.6.9, is in
patch-o-matic), please use this value.
- Consider using a slab cache instead of kmalloc for your dat_len
- Harald Welte <email@example.com> http://www.netfilter.org/
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
-----END PGP SIGNATURE-----
More information about the netfilter-devel