add TARPIT support to netfilter/iptables * netfilter: add the xt_TARPIT target module required by xt_CHAOS * include/netfilter.mk: reorder, xt_CHAOS depends on xt_TARPIT and xt_DELUDE * iptables: add libipt_TARPIT to the kmod-ipt-extra package, bump release number * original patchset can be found [http://tinyurl.com/2mjk2kx here]
SVN-Revision: 9178
This commit is contained in:
Gabor Juhos
parent
ab72460ac6
commit
8309e3dff2
@ -1,4 +1,4 @@
|
||||
#
|
||||
#
|
||||
# Copyright (C) 2006 OpenWrt.org
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v2.
|
||||
@ -60,8 +60,9 @@ $(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_MATCH_PORTSCAN, $(P_XT)xt_por
|
||||
#$(eval $(call nf_add,IPT_EXTRA,CONFIG_IP_NF_MATCH_QUOTA, $(P_V4)ipt_quota))
|
||||
$(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_MATCH_QUOTA, $(P_XT)xt_quota))
|
||||
|
||||
$(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_TARGET_CHAOS, $(P_XT)xt_CHAOS))
|
||||
$(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_TARGET_TARPIT, $(P_XT)xt_TARPIT))
|
||||
$(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_TARGET_DELUDE, $(P_XT)xt_DELUDE))
|
||||
$(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_TARGET_CHAOS, $(P_XT)xt_CHAOS))
|
||||
$(eval $(call nf_add,IPT_EXTRA,CONFIG_IP_NF_TARGET_LOG, $(P_V4)ipt_LOG))
|
||||
$(eval $(call nf_add,IPT_EXTRA,CONFIG_IP_NF_TARGET_REJECT, $(P_V4)ipt_REJECT))
|
||||
#$(eval $(call nf_add,IPT_EXTRA,CONFIG_IP_NF_TARGET_ROUTE, $(P_V4)ipt_ROUTE))
|
||||
|
||||
@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk
|
||||
|
||||
PKG_NAME:=iptables
|
||||
PKG_VERSION:=1.3.8
|
||||
PKG_RELEASE:=1
|
||||
PKG_RELEASE:=2
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
|
||||
PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
|
||||
@ -166,7 +166,11 @@ define Package/iptables-mod-extra/description
|
||||
- libipt_physdev
|
||||
- libipt_pkttype
|
||||
- libipt_recent
|
||||
- iptable_raw
|
||||
- libipt_NOTRACK
|
||||
- libipt_TARPIT
|
||||
- libipt_DELUDE
|
||||
- libipt_CHAOS
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-ipset
|
||||
|
||||
106
package/iptables/patches/009-tarpit-support.patch
Normal file
106
package/iptables/patches/009-tarpit-support.patch
Normal file
@ -0,0 +1,106 @@
|
||||
diff -N -u -r iptables-1.3.8-20070817/extensions/libipt_TARPIT.c iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.c
|
||||
--- iptables-1.3.8-20070817/extensions/libipt_TARPIT.c 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.c 2007-08-18 14:49:25.000000000 -0400
|
||||
@@ -0,0 +1,58 @@
|
||||
+/* Shared library add-on to iptables for TARPIT support */
|
||||
+#include <stdio.h>
|
||||
+#include <getopt.h>
|
||||
+#include <iptables.h>
|
||||
+
|
||||
+static void
|
||||
+help(void)
|
||||
+{
|
||||
+ fputs(
|
||||
+"TARPIT takes no options\n"
|
||||
+"\n", stdout);
|
||||
+}
|
||||
+
|
||||
+static struct option opts[] = {
|
||||
+ { 0 }
|
||||
+};
|
||||
+
|
||||
+static int
|
||||
+parse(int c, char **argv, int invert, unsigned int *flags,
|
||||
+ const struct ipt_entry *entry,
|
||||
+ struct ipt_entry_target **target)
|
||||
+{
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static void final_check(unsigned int flags)
|
||||
+{
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+print(const struct ipt_ip *ip,
|
||||
+ const struct ipt_entry_target *target,
|
||||
+ int numeric)
|
||||
+{
|
||||
+}
|
||||
+
|
||||
+static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
|
||||
+{
|
||||
+}
|
||||
+
|
||||
+static struct iptables_target tarpit = {
|
||||
+ .next = NULL,
|
||||
+ .name = "TARPIT",
|
||||
+ .version = IPTABLES_VERSION,
|
||||
+ .size = IPT_ALIGN(0),
|
||||
+ .userspacesize = IPT_ALIGN(0),
|
||||
+ .help = &help,
|
||||
+ .parse = &parse,
|
||||
+ .final_check = &final_check,
|
||||
+ .print = &print,
|
||||
+ .save = &save,
|
||||
+ .extra_opts = opts
|
||||
+};
|
||||
+
|
||||
+void _init(void)
|
||||
+{
|
||||
+ register_target(&tarpit);
|
||||
+}
|
||||
diff -N -u -r iptables-1.3.8-20070817/extensions/libipt_TARPIT.man iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.man
|
||||
--- iptables-1.3.8-20070817/extensions/libipt_TARPIT.man 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.man 2007-08-18 14:49:25.000000000 -0400
|
||||
@@ -0,0 +1,34 @@
|
||||
+Captures and holds incoming TCP connections using no local
|
||||
+per-connection resources. Connections are accepted, but immediately
|
||||
+switched to the persist state (0 byte window), in which the remote
|
||||
+side stops sending data and asks to continue every 60-240 seconds.
|
||||
+Attempts to close the connection are ignored, forcing the remote side
|
||||
+to time out the connection in 12-24 minutes.
|
||||
+
|
||||
+This offers similar functionality to LaBrea
|
||||
+<http://www.hackbusters.net/LaBrea/> but doesn't require dedicated
|
||||
+hardware or IPs. Any TCP port that you would normally DROP or REJECT
|
||||
+can instead become a tarpit.
|
||||
+
|
||||
+To tarpit connections to TCP port 80 destined for the current machine:
|
||||
+.IP
|
||||
+iptables -A INPUT -p tcp -m tcp --dport 80 -j TARPIT
|
||||
+.P
|
||||
+To significantly slow down Code Red/Nimda-style scans of unused address
|
||||
+space, forward unused ip addresses to a Linux box not acting as a router
|
||||
+(e.g. "ip route 10.0.0.0 255.0.0.0 ip.of.linux.box" on a Cisco), enable IP
|
||||
+forwarding on the Linux box, and add:
|
||||
+.IP
|
||||
+iptables -A FORWARD -p tcp -j TARPIT
|
||||
+.IP
|
||||
+iptables -A FORWARD -j DROP
|
||||
+.TP
|
||||
+NOTE:
|
||||
+If you use the conntrack module while you are using TARPIT, you should
|
||||
+also use the NOTRACK target, or the kernel will unnecessarily allocate
|
||||
+resources for each TARPITted connection. To TARPIT incoming
|
||||
+connections to the standard IRC port while using conntrack, you could:
|
||||
+.IP
|
||||
+iptables -t raw -A PREROUTING -p tcp --dport 6667 -j NOTRACK
|
||||
+.IP
|
||||
+iptables -A INPUT -p tcp --dport 6667 -j TARPIT
|
||||
diff -N -u -r iptables-1.3.8-20070817/extensions/.TARPIT-test iptables-1.3.8-20070817-nf/extensions/.TARPIT-test
|
||||
--- iptables-1.3.8-20070817/extensions/.TARPIT-test 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ iptables-1.3.8-20070817-nf/extensions/.TARPIT-test 2007-08-18 14:49:25.000000000 -0400
|
||||
@@ -0,0 +1,2 @@
|
||||
+#! /bin/sh
|
||||
+[ -f $KERNEL_DIR/net/netfilter/xt_TARPIT.c ] && echo TARPIT
|
||||
@ -250,6 +250,9 @@ define KernelPackage/ipt-extra/description
|
||||
- ipt_recent
|
||||
- iptable_raw
|
||||
- xt_NOTRACK
|
||||
- xt_TARPIT
|
||||
- xt_DELUDE
|
||||
- xt_CHAOS
|
||||
endef
|
||||
|
||||
$(eval $(call KernelPackage,ipt-extra))
|
||||
|
||||
@ -745,6 +745,7 @@ CONFIG_NETFILTER_XT_TARGET_MARK=m
|
||||
CONFIG_NETFILTER_XT_TARGET_NFLOG=m
|
||||
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
|
||||
CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
|
||||
CONFIG_NETFILTER_XT_TARGET_TARPIT=m
|
||||
CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
|
||||
# CONFIG_NETPOLL is not set
|
||||
# CONFIG_NETROM is not set
|
||||
|
||||
@ -0,0 +1,325 @@
|
||||
Index: linux-2.6.22.4/net/netfilter/Kconfig
|
||||
===================================================================
|
||||
--- linux-2.6.22.4.orig/net/netfilter/Kconfig
|
||||
+++ linux-2.6.22.4/net/netfilter/Kconfig
|
||||
@@ -379,6 +379,23 @@ config NETFILTER_XT_TARGET_CONNSECMARK
|
||||
|
||||
To compile it as a module, choose M here. If unsure, say N.
|
||||
|
||||
+config NETFILTER_XT_TARGET_TARPIT
|
||||
+ tristate '"TARPIT" target support'
|
||||
+ depends on NETFILTER_XTABLES
|
||||
+ ---help---
|
||||
+ Adds a TARPIT target to iptables, which captures and holds
|
||||
+ incoming TCP connections using no local per-connection resources.
|
||||
+ Connections are accepted, but immediately switched to the persist
|
||||
+ state (0 byte window), in which the remote side stops sending data
|
||||
+ and asks to continue every 60-240 seconds. Attempts to close the
|
||||
+ connection are ignored, forcing the remote side to time out the
|
||||
+ connection in 12-24 minutes.
|
||||
+
|
||||
+ This offers similar functionality to LaBrea
|
||||
+ <http://www.hackbusters.net/LaBrea/>, but does not require dedicated
|
||||
+ hardware or IPs. Any TCP port that you would normally DROP or REJECT
|
||||
+ can instead become a tarpit.
|
||||
+
|
||||
config NETFILTER_XT_TARGET_TCPMSS
|
||||
tristate '"TCPMSS" target support'
|
||||
depends on NETFILTER_XTABLES && (IPV6 || IPV6=n)
|
||||
Index: linux-2.6.22.4/net/netfilter/Makefile
|
||||
===================================================================
|
||||
--- linux-2.6.22.4.orig/net/netfilter/Makefile
|
||||
+++ linux-2.6.22.4/net/netfilter/Makefile
|
||||
@@ -47,6 +47,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE
|
||||
obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o
|
||||
obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
|
||||
obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
|
||||
+obj-$(CONFIG_NETFILTER_XT_TARGET_TARPIT) += xt_TARPIT.o
|
||||
obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
|
||||
obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
|
||||
|
||||
Index: linux-2.6.22.4/net/netfilter/xt_TARPIT.c
|
||||
===================================================================
|
||||
--- /dev/null
|
||||
+++ linux-2.6.22.4/net/netfilter/xt_TARPIT.c
|
||||
@@ -0,0 +1,280 @@
|
||||
+/*
|
||||
+ * Kernel module to capture and hold incoming TCP connections using
|
||||
+ * no local per-connection resources.
|
||||
+ *
|
||||
+ * Based on ipt_REJECT.c and offering functionality similar to
|
||||
+ * LaBrea <http://www.hackbusters.net/LaBrea/>.
|
||||
+ *
|
||||
+ * Copyright (c) 2002 Aaron Hopkins <tools@die.net>
|
||||
+ *
|
||||
+ * This program is free software; you can redistribute it and/or modify
|
||||
+ * it under the terms of the GNU General Public License as published by
|
||||
+ * the Free Software Foundation; either version 2 of the License, or
|
||||
+ * (at your option) any later version.
|
||||
+ *
|
||||
+ * This program is distributed in the hope that it will be useful,
|
||||
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
+ * GNU General Public License for more details.
|
||||
+ *
|
||||
+ * You should have received a copy of the GNU General Public License
|
||||
+ * along with this program; if not, write to the Free Software
|
||||
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
||||
+ *
|
||||
+ * Goal:
|
||||
+ * - Allow incoming TCP connections to be established.
|
||||
+ * - Passing data should result in the connection being switched to the
|
||||
+ * persist state (0 byte window), in which the remote side stops sending
|
||||
+ * data and asks to continue every 60 seconds.
|
||||
+ * - Attempts to shut down the connection should be ignored completely, so
|
||||
+ * the remote side ends up having to time it out.
|
||||
+ *
|
||||
+ * This means:
|
||||
+ * - Reply to TCP SYN,!ACK,!RST,!FIN with SYN-ACK, window 5 bytes
|
||||
+ * - Reply to TCP SYN,ACK,!RST,!FIN with RST to prevent spoofing
|
||||
+ * - Reply to TCP !SYN,!RST,!FIN with ACK, window 0 bytes, rate-limited
|
||||
+ */
|
||||
+
|
||||
+#include <linux/version.h>
|
||||
+#include <linux/module.h>
|
||||
+#include <linux/skbuff.h>
|
||||
+#include <linux/ip.h>
|
||||
+#include <net/ip.h>
|
||||
+#include <net/tcp.h>
|
||||
+#include <net/icmp.h>
|
||||
+struct in_device;
|
||||
+#include <net/route.h>
|
||||
+#include <linux/random.h>
|
||||
+#include <linux/netfilter_ipv4/ip_tables.h>
|
||||
+
|
||||
+#if 0
|
||||
+#define DEBUGP printk
|
||||
+#else
|
||||
+#define DEBUGP(format, args...)
|
||||
+#endif
|
||||
+
|
||||
+/* Stolen from ip_finish_output2 */
|
||||
+static int ip_direct_send(struct sk_buff *skb)
|
||||
+{
|
||||
+ struct dst_entry *dst = skb->dst;
|
||||
+
|
||||
+ if (dst->hh != NULL)
|
||||
+ return neigh_hh_output(dst->hh, skb);
|
||||
+ else if (dst->neighbour != NULL)
|
||||
+ return dst->neighbour->output(skb);
|
||||
+
|
||||
+ if (net_ratelimit())
|
||||
+ printk(KERN_DEBUG "TARPIT ip_direct_send: no header cache and no neighbor!\n");
|
||||
+
|
||||
+ kfree_skb(skb);
|
||||
+ return -EINVAL;
|
||||
+}
|
||||
+
|
||||
+
|
||||
+/* Send reply */
|
||||
+static void tarpit_tcp(const struct sk_buff *oskb, struct rtable *ort,
|
||||
+ unsigned int local)
|
||||
+{
|
||||
+ struct sk_buff *nskb;
|
||||
+ struct rtable *nrt;
|
||||
+ struct tcphdr *otcph, *ntcph;
|
||||
+ struct flowi fl = {};
|
||||
+ unsigned int otcplen;
|
||||
+ u_int16_t tmp;
|
||||
+
|
||||
+ const struct iphdr *oiph = ip_hdr(oskb);
|
||||
+ struct iphdr *niph;
|
||||
+
|
||||
+ /* A truncated TCP header is not going to be useful */
|
||||
+ if (oskb->len < ip_hdrlen(oskb) + sizeof(struct tcphdr))
|
||||
+ return;
|
||||
+
|
||||
+ otcph = (void *)oiph + ip_hdrlen(oskb);
|
||||
+ otcplen = oskb->len - ip_hdrlen(oskb);
|
||||
+
|
||||
+ /* No replies for RST or FIN */
|
||||
+ if (otcph->rst || otcph->fin)
|
||||
+ return;
|
||||
+
|
||||
+ /* No reply to !SYN,!ACK. Rate-limit replies to !SYN,ACKs */
|
||||
+ if (!otcph->syn && (!otcph->ack || !xrlim_allow(&ort->u.dst, 1*HZ)))
|
||||
+ return;
|
||||
+
|
||||
+ /* Check checksum. */
|
||||
+ if (tcp_v4_check(otcplen, oiph->saddr, oiph->daddr,
|
||||
+ csum_partial((char *)otcph, otcplen, 0)) != 0)
|
||||
+ return;
|
||||
+
|
||||
+ /*
|
||||
+ * Copy skb (even if skb is about to be dropped, we cannot just
|
||||
+ * clone it because there may be other things, such as tcpdump,
|
||||
+ * interested in it)
|
||||
+ */
|
||||
+ nskb = skb_copy(oskb, GFP_ATOMIC);
|
||||
+ if (nskb == NULL)
|
||||
+ return;
|
||||
+
|
||||
+ niph = ip_hdr(nskb);
|
||||
+
|
||||
+ /* This packet will not be the same as the other: clear nf fields */
|
||||
+ nf_conntrack_put(nskb->nfct);
|
||||
+ nskb->nfct = NULL;
|
||||
+#ifdef CONFIG_NETFILTER_DEBUG
|
||||
+ nskb->nf_debug = 0;
|
||||
+#endif
|
||||
+
|
||||
+ ntcph = (void *)niph + ip_hdrlen(nskb);
|
||||
+
|
||||
+ /* Truncate to length (no data) */
|
||||
+ ntcph->doff = sizeof(struct tcphdr)/4;
|
||||
+ skb_trim(nskb, ip_hdrlen(nskb) + sizeof(struct tcphdr));
|
||||
+ niph->tot_len = htons(nskb->len);
|
||||
+
|
||||
+ /* Swap source and dest */
|
||||
+ niph->daddr = xchg(&niph->saddr, niph->daddr);
|
||||
+ tmp = ntcph->source;
|
||||
+ ntcph->source = ntcph->dest;
|
||||
+ ntcph->dest = tmp;
|
||||
+
|
||||
+ /* Use supplied sequence number or make a new one */
|
||||
+ ntcph->seq = otcph->ack ? otcph->ack_seq
|
||||
+ : htonl(secure_tcp_sequence_number(niph->saddr,
|
||||
+ niph->daddr,
|
||||
+ ntcph->source,
|
||||
+ ntcph->dest));
|
||||
+
|
||||
+ /* Our SYN-ACKs must have a >0 window */
|
||||
+ ntcph->window = (otcph->syn && !otcph->ack) ? htons(5) : 0;
|
||||
+
|
||||
+ ntcph->urg_ptr = 0;
|
||||
+
|
||||
+ /* Reset flags */
|
||||
+ ((u_int8_t *)ntcph)[13] = 0;
|
||||
+
|
||||
+ if (otcph->syn && otcph->ack) {
|
||||
+ ntcph->rst = 1;
|
||||
+ ntcph->ack_seq = 0;
|
||||
+ } else {
|
||||
+ ntcph->syn = otcph->syn;
|
||||
+ ntcph->ack = 1;
|
||||
+ ntcph->ack_seq = htonl(ntohl(otcph->seq) + otcph->syn);
|
||||
+ }
|
||||
+
|
||||
+ /* Adjust TCP checksum */
|
||||
+ ntcph->check = 0;
|
||||
+ ntcph->check = tcp_v4_check(sizeof(struct tcphdr),
|
||||
+ niph->saddr,
|
||||
+ niph->daddr,
|
||||
+ csum_partial((char *)ntcph,
|
||||
+ sizeof(struct tcphdr), 0));
|
||||
+
|
||||
+ fl.nl_u.ip4_u.daddr = niph->daddr;
|
||||
+ fl.nl_u.ip4_u.saddr = local ? niph->saddr : 0;
|
||||
+ fl.nl_u.ip4_u.tos = RT_TOS(niph->tos) | RTO_CONN;
|
||||
+ fl.oif = 0;
|
||||
+
|
||||
+ if (ip_route_output_key(&nrt, &fl))
|
||||
+ goto free_nskb;
|
||||
+
|
||||
+ dst_release(nskb->dst);
|
||||
+ nskb->dst = &nrt->u.dst;
|
||||
+
|
||||
+ /* Adjust IP TTL */
|
||||
+ niph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);
|
||||
+
|
||||
+ /* Set DF, id = 0 */
|
||||
+ niph->frag_off = htons(IP_DF);
|
||||
+ niph->id = 0;
|
||||
+
|
||||
+ /* Adjust IP checksum */
|
||||
+ niph->check = 0;
|
||||
+ niph->check = ip_fast_csum((unsigned char *)niph, niph->ihl);
|
||||
+
|
||||
+ /* "Never happens" */
|
||||
+ if (nskb->len > dst_mtu(nskb->dst))
|
||||
+ goto free_nskb;
|
||||
+
|
||||
+ ip_direct_send(nskb);
|
||||
+ return;
|
||||
+
|
||||
+ free_nskb:
|
||||
+ kfree_skb(nskb);
|
||||
+}
|
||||
+
|
||||
+static unsigned int xt_tarpit_target(struct sk_buff **pskb,
|
||||
+ const struct net_device *in,
|
||||
+ const struct net_device *out,
|
||||
+ unsigned int hooknum,
|
||||
+ const struct xt_target *target,
|
||||
+ const void *targinfo)
|
||||
+{
|
||||
+ const struct sk_buff *skb = *pskb;
|
||||
+ const struct iphdr *iph = ip_hdr(skb);
|
||||
+ struct rtable *rt = (void *)skb->dst;
|
||||
+
|
||||
+ /* Do we have an input route cache entry? */
|
||||
+ if (rt == NULL)
|
||||
+ return NF_DROP;
|
||||
+
|
||||
+ /* No replies to physical multicast/broadcast */
|
||||
+ if (skb->pkt_type != PACKET_HOST && skb->pkt_type != PACKET_OTHERHOST)
|
||||
+ return NF_DROP;
|
||||
+
|
||||
+ /* Now check at the protocol level */
|
||||
+ if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
|
||||
+ return NF_DROP;
|
||||
+
|
||||
+ /*
|
||||
+ * Our naive response construction does not deal with IP
|
||||
+ * options, and probably should not try.
|
||||
+ */
|
||||
+ if (iph->ihl * 4 != sizeof(struct iphdr))
|
||||
+ return NF_DROP;
|
||||
+
|
||||
+ /* We are not interested in fragments */
|
||||
+ if (iph->frag_off & htons(IP_OFFSET))
|
||||
+ return NF_DROP;
|
||||
+
|
||||
+ tarpit_tcp(skb, rt, hooknum == NF_IP_LOCAL_IN);
|
||||
+ return NF_DROP;
|
||||
+}
|
||||
+
|
||||
+static bool xt_tarpit_check(const char *tablename, const void *entry,
|
||||
+ const struct xt_target *target, void *targinfo,
|
||||
+ unsigned int hook_mask)
|
||||
+{
|
||||
+ bool invalid;
|
||||
+
|
||||
+ if (strcmp(tablename, "raw") == 0 && hook_mask == NF_IP_PRE_ROUTING)
|
||||
+ return true;
|
||||
+ if (strcmp(tablename, "filter") != 0)
|
||||
+ return false;
|
||||
+ invalid = hook_mask & ~((1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD));
|
||||
+ return !invalid;
|
||||
+}
|
||||
+
|
||||
+static struct xt_target xt_tarpit_reg = {
|
||||
+ .name = "TARPIT",
|
||||
+ .family = AF_INET,
|
||||
+ .proto = IPPROTO_TCP,
|
||||
+ .target = xt_tarpit_target,
|
||||
+ .checkentry = xt_tarpit_check,
|
||||
+ .me = THIS_MODULE,
|
||||
+};
|
||||
+
|
||||
+static int __init xt_tarpit_init(void)
|
||||
+{
|
||||
+ return xt_register_target(&xt_tarpit_reg);
|
||||
+}
|
||||
+
|
||||
+static void __exit xt_tarpit_exit(void)
|
||||
+{
|
||||
+ xt_unregister_target(&xt_tarpit_reg);
|
||||
+}
|
||||
+
|
||||
+module_init(xt_tarpit_init);
|
||||
+module_exit(xt_tarpit_exit);
|
||||
+MODULE_DESCRIPTION("netfilter xt_TARPIT target module");
|
||||
+MODULE_AUTHOR("Jan Engelhardt <jengelh@gmx.de>");
|
||||
+MODULE_LICENSE("GPL");
|
||||
+MODULE_ALIAS("ipt_TARPIT");
|
||||
Loading…
Reference in New Issue
Block a user