lkml.org 
[lkml]   [1998]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: content-filtering of tcp-ip-packages

In article <3660111C.781662ED@uni-bremen.de> you wrote:
> I would like to hack firewall-part of the kernel so that it would not
> let through any java-script or java or activ-x stuff. I think about some
> kind of string recognition for Java-(script) and some recognition of the
> file-name (*.ocx) for activ-X.

See the paper "Blocking Java Applets at the Firewall" by Martin,
Rajagoapalan and Rubin from
http://www.cs.bu.edu/techreports/96-026-java-firewalls.ps.Z

They explain why it is better to do this sort of thing
in app-level proxies than in packet filters (IP packets
are fragmented, proxies see the whole data stream, also
compressed, encrypted, encoded, attached files don't
necessarily contain the magic byte sequences, while
legitimate IP traffic might well). Apparently http-gw
from the TIS toolkit can be configured to block Java, but
as you will see in the article, it's a difficult business.

--
Erik Corry erik@arbat.com Ceterum censeo, Microsoftem esse delendam!

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:45    [from the cache]
©2003-2011 Jasper Spaans