I've already written masquerading (I call it "address translation") as part of a revised user-land PPP daemon, and it works great... even handles FTP control stream hackery. Of course, this has nothing to do with PPP. It's only because PPP, using /dev/tun0 on one side and a serial link on the other, can act as such a filter.

I strongly agree it would be nice (and morally correct) to keep this type of hackery out of the kernel.

There's a larger question here then, which is that we need a more general mechanism for user-land "filtering" (in the most general sense) of packets as they cross an interface. BPF and /dev/tun? are both great, but you can't implement a filter with them.

Firewalling, encryption, and accounting are examples too.

Poul-Henning suggested some ideas about this a while back, but I haven't heard if he plans on developing them.

A simple idea would be to have "detour" devices where you could open /dev/filteri0 and /dev/filtero0, attach them to some interface, and have all packets (optionally before or after (de)fragmentation) passing through that interface routed up one and down the other.

Better yet, with devfs, they could even have names like /dev/if_ed1 and /dev/of_ed1 and no binding operation would be necessary. Then the picture would look roughly like this:

--> /dev/if_ed1 --> / \ network <--> interface ed1 <--> <--> kernel routing \ / <-- /dev/of_ed1 <--

When either file is not open, packets pass normally without the detour, and with normal kernel speed. When one is open, you get to play your games with them but pay a penalty in speed. In the same way that user land PPP has become more popular and widely developed than kernel land PPP, even though it is supposedly slower, I think something like this would also be a net gain both for fostering useful developments and fighting kernel bloat.

I guess you could also do this just using the existing tunnel devices with some kind of "redirect" ioctl().

Terry, what do you think of this idea? How would you design a general purpose user land filtering mechanism?

-Archie