[lkml]   [1998]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: content-filtering of tcp-ip-packages

In article <> you wrote:
> I would like to hack firewall-part of the kernel so that it would not
> let through any java-script or java or activ-x stuff. I think about some
> kind of string recognition for Java-(script) and some recognition of the
> file-name (*.ocx) for activ-X.

See the paper "Blocking Java Applets at the Firewall" by Martin,
Rajagoapalan and Rubin from

They explain why it is better to do this sort of thing
in app-level proxies than in packet filters (IP packets
are fragmented, proxies see the whole data stream, also
compressed, encrypted, encoded, attached files don't
necessarily contain the magic byte sequences, while
legitimate IP traffic might well). Apparently http-gw
from the TIS toolkit can be configured to block Java, but
as you will see in the article, it's a difficult business.

Erik Corry Ceterum censeo, Microsoftem esse delendam!

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:45    [W:0.034 / U:8.644 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site