On Thu, Nov 06, 2003 at 10:14:36AM -0500, Small, Jim wrote: > I would also be curious if anyone has heard of other L7 filters that work > well with pf. You see Daniel and Henning, we're so spoiled by pf, OpenBSD, > and OpenSSH that we're hoping there's an L7 filter project like that...
If someone shows me how to do it correctly, that might even convince me to try to implement it in pf. But what I've seen so far were horrible kludges in the sense that I can immediately predict a dozen ways it will raise false alarms or be easily circumvented by a moderately clever tool. What I'd want is a scheme that I myself could trust. For instance, I personally dislike the idea of 'search for substring HTTP/1.1 in the payload and assume protocol HTTP when found' or anything inaccurate like that. Would this very email be blocked by some firewalls because they see the string in the (SMTP) payload? Searching payload of individual packets independantly is just guesswork. Even if many people consider that 'good enough' and 'helpful in some cases', I find it too ugly to invest time. I rather pick something else I can do properly. Daniel
