I agree that trying to do too much in a firewall can be bad and even dangerous. However, Layer 7 Filtering/Proxying can be extremely useful. I believe the key is to use a layered approach. You would have a border firewall and then you could have a l7/proxy server behind it.
L7/Proxy servers have become extremely important because of tunneling. Pretty much anything can run over http/80 or https/443. A firewall is no longer sufficient by itself. You need something peering into the packets and deciding if it's really http or it's gnutella, Kazaa, AIM, etc... This is especially important with IM and P2P apps which are often not written with security in mind (to put it nicely) and left running all the time. Essentially these provide a back door into your network and if you leave the http port open... Henning is right though. Trying to put too many features into pf would be bad. Better to have add on patches like with Netfilter/IPTables or even better a separate project. Two worth looking at for OpenBSD are: Hogwash: http://sourceforge.net/projects/hogwash -and- http_filter: http://glob.com.au/http_filter/ (Warning--written in perl so not for high performance) Of course many "plugins" can also be found for squid. I would also be curious if anyone has heard of other L7 filters that work well with pf. You see Daniel and Henning, we're so spoiled by pf, OpenBSD, and OpenSSH that we're hoping there's an L7 filter project like that... <> Jim > -----Original Message----- > From: Henning Brauer [mailto:[EMAIL PROTECTED] > Sent: Thursday, November 06, 2003 6:03 AM > To: [EMAIL PROTECTED] > Subject: Re: pf with any l7 patches or ability? > > l7 filtering is basically just a buzzword. > you have it since years - it's called "proxy". > what they mean by the new buzzword is integrating the config, and > perhaps doing this in kernel land. > to get an idea why l7 stuff in kernel is a bad bad bad bad idea, look > at ipf - search bugtraq for the problems it had with its in-kernel > ftp-proxy. > or look at netfilter, they've just been bitten by their in-kernel > "connection tracking" for ftp and irc as well. bugtraq is your friend > here too ;-) > I don't believe paketeer or anything else is doing any better. it's > simply a design fault. > > On Wed, Nov 05, 2003 at 10:05:36PM -0600, Nick Buraglio wrote: > > I don't necessarily disagree. I had a feeling I was chasing a ghost, > > but I have a need for a packeteer-ish appliance without the price. The > > reason I was looking at openbsd was that I like the bridge code. It > > works well, it's not hard to configure and best of all pf is there. > > The real problem is that in the locations I need to put these > > theoretical devices the owners are too cheap to buy good equipment that > > could perform the job so I search for a hack to do a similar job. > > worst case is that I use linux with the l7 patches. I'd just prefer to > > use a BSD, not necessarily pf, I figured that people on this list may > > have some idea. > > > > Thanks again. > > > > nb > > > > > > On Nov 5, 2003, at 7:51 PM, Laurent Cheylus wrote: > > > > >Hi, > > > > > >Quoting Nick Buraglio <[EMAIL PROTECTED]>: > > > > > >>I'm looking for anyone that knows of a bsd project that does something > > >>similar to to the Linux Layer 7 filter project. Details found here: > > >>http://l7-filter.sourceforge.net/ I'm more or less hoping that > > >>someone > > >>has a *BSD project that can classify packets based on application data > > >>in the connections they belong to or that there is a patch for pf to > > >>do > > >>this. Is there anything in the works that anyone knows of? > > > > > >If you read the recent archives of ths list, you could see that > > >'official' PF > > >devs (Daniel, Henning) don't want work on data payload inspection (bad > > >performances to do things like that in kernel space....). > > > > > >In my opinion, classify packets based on application data is a (very) > > >bad idea > > >for security. If you decide to block or accept packet with rule only > > >based on > > >app data and a too simple grammar for classification, it's too easy to > > >fake your > > >ruleset. > > > > > I don't really want to block or pass, just shape. > > > > >Exemple : > > >- pass in on $EXT from any to POP3_SERVER app POP3 ('app' is a new > > >keyword for > > >classification based on app data) > > >- the grammar for POP3 protocol of L7-filter project > > >- by sending a packet with payload 'pop3', your packet is accepted > > >even if it's > > >not a packet for POP3 exchange > > > > > >A++ Foxy > > > > > >-- > > >Laurent Cheylus <[EMAIL PROTECTED]> OpenPGP ID 0x5B766EC2 > > > > > > > > > -- > Henning Brauer, BS Web Services, http://bsws.de > [EMAIL PROTECTED] - [EMAIL PROTECTED] > Unix is very simple, but it takes a genius to understand the simplicity. > (Dennis Ritchie)
