Changli Gao wrote: > I have implemented a simple SYNPROXY iptables target. It is much like > the SYNPROXY implementation in pf of OpenBSD, but won't have state > until the first connection is established with the help of syncookies. > The code is hosted at github: > > http://github.com/xiaosuo/xiaosuo/tree/master/synproxy/ > > Currently, it can work with firewall and local socket. > > It is in the very early stage, and ugly. And I will add --timeout > parameter to this target as TCP_DFER_ACCEPT, so I can do NAT basing on > the request data. > > i.e. > > iptables -t nat -A OUTPUT -p tcp -m synproxy --http-url "*.jpg" -j > DNAT --to-destination $image_http_server:80 > > And is there any chance to merge it into mainline? If you can state a good use case, sure. I don't know much about the PF synproxy myself. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
