At the moment I am looking for some way on Linux to have packet filter whitelisting done but based on fine-grained parameters such as packet content rather than more general parameters such as protocol type or IP source.
A security critical application running on the firewalled host must not be able to see or parse the data sent until it passes a firewall filter that only allows packets with certain predefined data (hardcoded text string commands) through.
In essence its a "seccomp-like" mechanism I'm looking for except the data source is a potentially malicious/untrusted application running on another machine.
Things I've looked but failed to understand if applicable to my use case:
- seccomp
- libpcap
- Linux Socket Filtering aka Berkeley Packet Filter (BPF)
- Snort