mgr/worker interface and extensions use case

[Marco d'Itri]

On Jun 17, Nils Goroll <nils.goroll at uplex.de> wrote:

>I have not implemented a prototype, but my understanding is that this 
>use case would actually need a CAP_NET_ADMIN capable process sending 
>the messages via the AF_NETLINK socket.
As we discussed online, I think that it is safer and easier to implement 
firewall management in a standalone and privileged daemon which receives 
requests from Vinyl Cache over a socket.

I have uploaded here a Perl server implementation and a test C client:
https://www.bofh.it/~md/tmp/wip-updater/ .

It still needs a proper name, but I think that it is a reasonable first 
release. It can be easily extended to support nftables and the *BSD 
firewall systems.

It is smart enough to batch requests received in a short time, so under 
attack it will spawn ipset once to update multiple entries.
I know that frequently running an external program from Perl is going to 
be efficient enough because I have been blocking DDoS attacks by running 
ipset for single IPs in a shell script's while loop.

What it needs now is somebody making a vmod client. Maybe first 
prototyped as inline C? (This would also be nice for teaching how inline 
C works, since there is not much "modern" documentation...)

-- 
ciao,
Marco
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <https://vinyl-cache.org/lists/pipermail/vinyl-dev/attachments/20260622/557568c4/attachment.bin>