absurd/README.md

40 lines
1.9 KiB
Markdown

ABSURD: A bewilderingly silly userspace routing daemon
======================================================
ABSURD is a TCP/IP routing and firewalling tool for performing stateful
firewalling and routing of IP traffic according to configurable rules.
Right now, no code exists, but the idea is as follows:
- The daemon will consist of a core packet switch which listens on a `tun`
interface and exposes some virtual subnets to the host, whilst providing an
interface to those subnets via a Unix-domain socket.
- Plug-in applications then connect to the Unix-domain socket and can
"register" interest in receiving particular subsets of the traffic routed to
the virtual subnet. They can also bind to virtual addresses on those
subnets to be able to initiate communications.
Some possible applications:
- Stateful NAT64 (RFC-6146) and NAT46 (draft-liu-behave-nat46-02), including
cross-protocol port forwarding.
- DNS64 (RFC-6147)
- PCP (RFC-6887)
- SNI-based routing, so your TLS server's logs show an IPv6 address derived
from the address of the IPv4 client for auditing purposes, instead of the IP
address of your SNI proxy server.
- Application-level firewalling (e.g. let your Wordpress blog access Wordpress
for security updates without having to know every IP they host sites on),
- Deep-packet inspection.
This is obviously not a replacement for netfilter, pf or any other firewall
you care to name. It's a compliment to it. Passing packets in and out of
userspace has the distinct downside of performance penalties, thus for high
performance routing, any kernel solution is going to run rings around this.
That said, on small home/business networks, the Internet link is typically
100Mbps or less, and even a Raspberry Pi packs a decent amount of computing
oomph. Likely, we should be able to keep up with most small Internet
connections. The aim will be for something that can keep up with ADSLv2 and
similar grade links on modest hardware.