Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2075

Re: iptables string match

Show all headers | View raw

Martijn Lievaart <m@rtij.nl.invlalid> wrote in
news:g1cp2a-rhd.ln1@news.rtij.nl: 

> On Mon, 01 Apr 2013 19:49:28 +0000, buck wrote:
> 
>> Is it possible to match a string in nat table PREROUTING?  I suspect
>> PREROUTING only sees new connections, so the content of the packet
>> cannot be examined.
> 
> PREROUTING sees all packets before routing, however, the nat table
> sees only the first packet of each connection.
> 
>> 
>> If not in nat, can mangle be used to mark packets matching a string> 
>> If 
> 
> Should work.
> 
>> so, can such a marked patcket be DNATted?  How?
> 
> Yes and no. What do you want to achieve? If it is not the first packet
> of a "connection", DNATting proabably does not do what you want.
> 
> M4

Thanks!

This may sound foolish, but there is very good reason for it.

I run IBM OmniFInd, which is the same crawler engine as Yahoo! uses to 
index web pages.  I need to serve a substitute robots.txt when OmniFind 
asks a remote host for its robots.txt.  The reason is that this is the 
fastest and most reliable way to purge from OmniFind those links that are 
404 or 410 (not found / gone).

I have no control over when OmniFind requests robots.txt from that 
particular remote host, so debugging is difficult.

What I've done is to set up a small web server on my gateway box that 
listens on port 1080 and serves only robots.txt (containing 559 bad links 
right now).  I hope that something like

iptables -t mangle -I PREROUTING -p tcp -m string --string robots.txt \
  -j MARK --set-mark 0x2
iptables -t nat -I OUTPUT -p tcp -m mark --mark 0x2 -j REDIRECT \
  --to-ports 1080

will cause the marked packets to be sent to my web server.  And 
accomplish the objective...

Note that the iptables "mangle" line above has been edited in hopes that 
removing a bunch of "stuff" will improve clarity with respect to what I'm 
trying to accomplish.
-- 
buck

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

iptables string match buck <buck@private.mil> - 2013-04-01 19:49 +0000
  Re: iptables string match Martijn Lievaart <m@rtij.nl.invlalid> - 2013-04-01 23:50 +0200
    Re: iptables string match buck <buck@private.mil> - 2013-04-01 22:36 +0000
      Re: iptables string match Martijn Lievaart <m@rtij.nl.invlalid> - 2013-04-02 19:52 +0200

csiph-web