string filtering in iptables, needs new kernel?
My main question then is more along the lines of how you do this on a linode.
I have compiled countless kernels from scratch, but I do not know what be needed on the linode, I have not messed with my kernel and I think you guys use some special kernels, I wouldn't want to disable anythign important.
The distro is Gentoo, so how would I go about building a kernel for this box with netfilter?
Or maybe someone knows how I can do this without recompiling the kerrnel? Thanks!
Can you tell me which .config options you need specifically?
Specifically it is:
CONFIGIPNFMATCHSTRING which allows you to
match a string in a whole packet.
Not sure if this is doable with the linode kernels but I would really like to find a way to drop packets based on strings in their payload.
…I would really like to find a way to drop packets based on strings in their payload.
No, you wouldn't. It's unreliable, because it only looks at a packet at a time, and there's no guarantee that the dangerous string "foobar" won't be split across two packets. It can happen accidentally, and the cracker can force it.
What you want is a proxy firewall, where you can look at the actual data stream, and parse it properly.