If you were to do this with the queue lib, then you'd ataualy have to either let the client establish the connection OR fake that the connection was established, before you get the HTTP request is sent to rule on. Also keep in mind that the servers/client might want to do a Keep-alive or long lived HTTP session, with multiple HTTP requests. Keeping track of that, from an NFNetlink/Queue based interface would be hecktic. > >> Unless there are a real lot of these addresses that are permitted, and >> they change rapidly, then I'd expect it would be a better design to >> get all the valid URIs from the MySQL query on init and store them in >> a linked list. > I am afraid this not an option, because my final goal is to integrate my > application with external vendor database using the vendor own API. > > >> Also, people already do this type of thing with an HTTP proxy like >> squid before the HTTPd. > > I've tested HTTP proxy before, but the overhead is very big, and I > couldn't get the proxy to handle high loads. > > Another problem with proxy servers is using the proxy own IP for > outgoing request, unfortunately using the same IP for many requests > trigger many IDSes to block the proxy IP. > > What I am trying to do is a light weight HTTP filter, by searching for > HTTP requests in packet traveling on the wire, with minimal TCP > reassembly to find HTTP requests spanning more than one packet. >
