OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: idea: content filtering
From: Wietse Venema (wietseporcupine.org)
Date: Fri May 12 2000 - 14:54:01 CDT

Bennett Todd:
> > If you can embed Perl directly inside the existing daemon that
> > already has the message in memory (which is what we do with INN),
> > you don't even need an additional read and write of the message to
> > get it to Perl.
>
> Now that approach is an unequivocal win. Sadly perhaps, but I think
> understandably given the security goals Wietse is so successfully
> pursuing, I don't think we can hope to see a Perl interpreter
> embedded in Postfix, no matter how handy it would be for some
> problems.

It can be part of a separate resident server, so that the cost is
twice the cost of Postfix (mostly disk I/O) plus the cost of the
resident filter (mostly CPU, unless it causes the machine to swap).

The trick of a resident filter is that your regexps are compiled
once, whereas an on-demand filter has to do the work upon each
invokation.

> > Basically, you write your persistant daemon in C, since C is much
> > better at doing that than Perl is (it handles signals reliably,
> > etc.). You then embed Perl into your persistant C daemon, loading
> > the Perl filtering code on startup. You handle all the IPC in C
> > and do the regex and filtering work in Perl, using both languages
> > for what they're good at.
>
> I can definitely see the performance of such an approach, and if you
> managed to avoid having the IPC connection setups cost anything, it
> could match or conceivably even slighly improve on the performance
> of my approach. But I wouldn't want to write the required C.

I'm glad I am a multi-lingual person. However in this case it should
be possible to handle the IPC in PERL. SMTP is easy if you don't
have to talk to every broken mailer in the world. And because
there is not a network involved, it is OK when PERL needs a bit of
time before it replies to ".".

        Wietse