lkml.org 
[lkml]   [1998]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: content-filtering of tcp-ip-packages

    In article <3660111C.781662ED@uni-bremen.de> you wrote:
    > I would like to hack firewall-part of the kernel so that it would not
    > let through any java-script or java or activ-x stuff. I think about some
    > kind of string recognition for Java-(script) and some recognition of the
    > file-name (*.ocx) for activ-X.

    See the paper "Blocking Java Applets at the Firewall" by Martin,
    Rajagoapalan and Rubin from
    http://www.cs.bu.edu/techreports/96-026-java-firewalls.ps.Z

    They explain why it is better to do this sort of thing
    in app-level proxies than in packet filters (IP packets
    are fragmented, proxies see the whole data stream, also
    compressed, encrypted, encoded, attached files don't
    necessarily contain the magic byte sequences, while
    legitimate IP traffic might well). Apparently http-gw
    from the TIS toolkit can be configured to block Java, but
    as you will see in the article, it's a difficult business.

    --
    Erik Corry erik@arbat.com Ceterum censeo, Microsoftem esse delendam!

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:45    [W:0.039 / U:31.168 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site