3 ms·
If performance becomes an issue, the packet processing stuff could be split out into a faster daemon. I'm surprised, I expected this to be an iptables frontend
by voltagex_ 10y ago
If performance becomes an issue, the packet processing stuff could be split out into a faster daemon.
I'm surprised, I expected this to be an iptables frontend.
- sasas 10y agoConnection requests shouldn't be a performance issue on a standard desktop.
- detaro 10y agoWhat would a "pure iptables front end" be and how would it learn about connection attempts? (Serious question, it's quite possible I'm forgetting an API) The used technique, redirecting initial packets to a netfilter queue and then marking the connection to offload further processing to the kernel seems like a reasonable way to do this from userspace.
- voltagex_ 10y agoI don't know enough about Linux networking - I didn't realise the distinction between iptables and netfilter. Off to do some reading - thanks.
- detaro 10y ago(I interpreted "iptables frontend" as probably meaning something that just generates iptables rules, that's why I was asking) netfilter is the underlying kernel infrastructure, that's used e.g. by iptables to set rules for packets. From this https://github.com/evilsocket/opensnitch/blob/master/opensnitch/snitch.py#L33 https://github.com/evilsocket/opensnitch/blob/master/opensni..., it looks like OpenSnitch uses iptables to set rules so that the kernel delivers outgoing packets that don't belong to an existing connection to a queue. It then can use said queue to only intercept those packets – if it lets them pass, a connection will be created and further packets will not be passed to/handled by OpenSnitch. It touches the first packet of each outgoing connection, but not all traffic.