Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2073 > unrolled thread

iptables string match

Back to article view | Back to comp.os.linux.networking

Contents

  iptables string match buck <buck@private.mil> - 2013-04-01 19:49 +0000
    Re: iptables string match Martijn Lievaart <m@rtij.nl.invlalid> - 2013-04-01 23:50 +0200
      Re: iptables string match buck <buck@private.mil> - 2013-04-01 22:36 +0000
        Re: iptables string match Martijn Lievaart <m@rtij.nl.invlalid> - 2013-04-02 19:52 +0200

#2073 — iptables string match

Is it possible to match a string in nat table PREROUTING?  I suspect 
PREROUTING only sees new connections, so the content of the packet cannot 
be examined.

If not in nat, can mangle be used to mark packets matching a string>  If 
so, can such a marked patcket be DNATted?  How?
-- 
buck

[toc] | [next] | [standalone]

#2074

On Mon, 01 Apr 2013 19:49:28 +0000, buck wrote:

> Is it possible to match a string in nat table PREROUTING?  I suspect
> PREROUTING only sees new connections, so the content of the packet
> cannot be examined.

PREROUTING sees all packets before routing, however, the nat table sees 
only the first packet of each connection.

> 
> If not in nat, can mangle be used to mark packets matching a string>  If

Should work.

> so, can such a marked patcket be DNATted?  How?

Yes and no. What do you want to achieve? If it is not the first packet of 
a "connection", DNATting proabably does not do what you want.

M4

[toc] | [prev] | [next] | [standalone]

#2075

Martijn Lievaart <m@rtij.nl.invlalid> wrote in
news:g1cp2a-rhd.ln1@news.rtij.nl: 

> On Mon, 01 Apr 2013 19:49:28 +0000, buck wrote:
> 
>> Is it possible to match a string in nat table PREROUTING?  I suspect
>> PREROUTING only sees new connections, so the content of the packet
>> cannot be examined.
> 
> PREROUTING sees all packets before routing, however, the nat table
> sees only the first packet of each connection.
> 
>> 
>> If not in nat, can mangle be used to mark packets matching a string> 
>> If 
> 
> Should work.
> 
>> so, can such a marked patcket be DNATted?  How?
> 
> Yes and no. What do you want to achieve? If it is not the first packet
> of a "connection", DNATting proabably does not do what you want.
> 
> M4

Thanks!

This may sound foolish, but there is very good reason for it.

I run IBM OmniFInd, which is the same crawler engine as Yahoo! uses to 
index web pages.  I need to serve a substitute robots.txt when OmniFind 
asks a remote host for its robots.txt.  The reason is that this is the 
fastest and most reliable way to purge from OmniFind those links that are 
404 or 410 (not found / gone).

I have no control over when OmniFind requests robots.txt from that 
particular remote host, so debugging is difficult.

What I've done is to set up a small web server on my gateway box that 
listens on port 1080 and serves only robots.txt (containing 559 bad links 
right now).  I hope that something like

iptables -t mangle -I PREROUTING -p tcp -m string --string robots.txt \
  -j MARK --set-mark 0x2
iptables -t nat -I OUTPUT -p tcp -m mark --mark 0x2 -j REDIRECT \
  --to-ports 1080

will cause the marked packets to be sent to my web server.  And 
accomplish the objective...

Note that the iptables "mangle" line above has been edited in hopes that 
removing a bunch of "stuff" will improve clarity with respect to what I'm 
trying to accomplish.
-- 
buck

[toc] | [prev] | [next] | [standalone]

#2077

On Mon, 01 Apr 2013 22:36:12 +0000, buck wrote:

>> Yes and no. What do you want to achieve? If it is not the first packet
>> of a "connection", DNATting proabably does not do what you want.
>> 
> 
> This may sound foolish, but there is very good reason for it.
> 
> I run IBM OmniFInd, which is the same crawler engine as Yahoo! uses to
> index web pages.  I need to serve a substitute robots.txt when OmniFind
> asks a remote host for its robots.txt.  The reason is that this is the
> fastest and most reliable way to purge from OmniFind those links that
> are 404 or 410 (not found / gone).
> 
> I have no control over when OmniFind requests robots.txt from that
> particular remote host, so debugging is difficult.
> 
> What I've done is to set up a small web server on my gateway box that
> listens on port 1080 and serves only robots.txt (containing 559 bad
> links right now).  I hope that something like
> 
> iptables -t mangle -I PREROUTING -p tcp -m string --string robots.txt \
>   -j MARK --set-mark 0x2
> iptables -t nat -I OUTPUT -p tcp -m mark --mark 0x2 -j REDIRECT \
>   --to-ports 1080
> 
> will cause the marked packets to be sent to my web server.  And
> accomplish the objective...
> 
> Note that the iptables "mangle" line above has been edited in hopes that
> removing a bunch of "stuff" will improve clarity with respect to what
> I'm trying to accomplish.

This will never work. You cannot DNAT a connection that is already set up.

Alternatives:
0) The above will (try to) redirect all requests for robots.txt, why not 
just replace it on the target webserver?
1) If OmniFind has a fixed IP, DNAT that (but that will redirect all 
requests, not just robots.txt)
2) Put a transparant proxy on the gateway that redirects requests 
robots.txt to your webserver and all other requests to the target 
webserver

Other stuff that may give you building blocks for a solution:
- Does OmniFind have a unique agent identifier?
- Target webserver is Apache? Many moduless can customize what is 
returned.

HTH,
M4

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web