package/iptables/patches/009-tarpit-support.patch

   1 diff -N -u -r iptables-1.3.8-20070817/extensions/libipt_TARPIT.c iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.c
   2 --- iptables-1.3.8-20070817/extensions/libipt_TARPIT.c  1969-12-31 19:00:00.000000000 -0500
   3 +++ iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.c       2007-08-18 14:49:25.000000000 -0400
   4 @@ -0,0 +1,58 @@
   5 +/* Shared library add-on to iptables for TARPIT support */
   6 +#include <stdio.h>
   7 +#include <getopt.h>
   8 +#include <iptables.h>
   9 +
  10 +static void
  11 +help(void)
  12 +{
  13 +       fputs(
  14 +"TARPIT takes no options\n"
  15 +"\n", stdout);
  16 +}
  17 +
  18 +static struct option opts[] = {
  19 +       { 0 }
  20 +};
  21 +
  22 +static int
  23 +parse(int c, char **argv, int invert, unsigned int *flags,
  24 +      const struct ipt_entry *entry,
  25 +      struct ipt_entry_target **target)
  26 +{
  27 +       return 0;
  28 +}
  29 +
  30 +static void final_check(unsigned int flags)
  31 +{
  32 +}
  33 +
  34 +static void
  35 +print(const struct ipt_ip *ip,
  36 +      const struct ipt_entry_target *target,
  37 +      int numeric)
  38 +{
  39 +}
  40 +
  41 +static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
  42 +{
  43 +}
  44 +
  45 +static struct iptables_target tarpit = {
  46 +       .next           = NULL,
  47 +       .name           = "TARPIT",
  48 +       .version        = IPTABLES_VERSION,
  49 +       .size           = IPT_ALIGN(0),
  50 +       .userspacesize  = IPT_ALIGN(0),
  51 +       .help           = &help,
  52 +       .parse          = &parse,
  53 +       .final_check    = &final_check,
  54 +       .print          = &print,
  55 +       .save           = &save,
  56 +       .extra_opts     = opts
  57 +};
  58 +
  59 +void _init(void)
  60 +{
  61 +       register_target(&tarpit);
  62 +}
  63 diff -N -u -r iptables-1.3.8-20070817/extensions/libipt_TARPIT.man iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.man
  64 --- iptables-1.3.8-20070817/extensions/libipt_TARPIT.man        1969-12-31 19:00:00.000000000 -0500
  65 +++ iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.man     2007-08-18 14:49:25.000000000 -0400
  66 @@ -0,0 +1,34 @@
  67 +Captures and holds incoming TCP connections using no local
  68 +per-connection resources. Connections are accepted, but immediately
  69 +switched to the persist state (0 byte window), in which the remote
  70 +side stops sending data and asks to continue every 60-240 seconds.
  71 +Attempts to close the connection are ignored, forcing the remote side
  72 +to time out the connection in 12-24 minutes.
  73 +
  74 +This offers similar functionality to LaBrea
  75 +<http://www.hackbusters.net/LaBrea/> but doesn't require dedicated
  76 +hardware or IPs. Any TCP port that you would normally DROP or REJECT
  77 +can instead become a tarpit.
  78 +
  79 +To tarpit connections to TCP port 80 destined for the current machine:
  80 +.IP
  81 +iptables -A INPUT -p tcp -m tcp --dport 80 -j TARPIT
  82 +.P
  83 +To significantly slow down Code Red/Nimda-style scans of unused address
  84 +space, forward unused ip addresses to a Linux box not acting as a router
  85 +(e.g. "ip route 10.0.0.0 255.0.0.0 ip.of.linux.box" on a Cisco), enable IP
  86 +forwarding on the Linux box, and add:
  87 +.IP
  88 +iptables -A FORWARD -p tcp -j TARPIT
  89 +.IP
  90 +iptables -A FORWARD -j DROP
  91 +.TP
  92 +NOTE:
  93 +If you use the conntrack module while you are using TARPIT, you should
  94 +also use the NOTRACK target, or the kernel will unnecessarily allocate
  95 +resources for each TARPITted connection. To TARPIT incoming
  96 +connections to the standard IRC port while using conntrack, you could:
  97 +.IP
  98 +iptables -t raw -A PREROUTING -p tcp --dport 6667 -j NOTRACK
  99 +.IP
 100 +iptables -A INPUT -p tcp --dport 6667 -j TARPIT
 101 diff -N -u -r iptables-1.3.8-20070817/extensions/.TARPIT-test iptables-1.3.8-20070817-nf/extensions/.TARPIT-test
 102 --- iptables-1.3.8-20070817/extensions/.TARPIT-test     1969-12-31 19:00:00.000000000 -0500
 103 +++ iptables-1.3.8-20070817-nf/extensions/.TARPIT-test  2007-08-18 14:49:25.000000000 -0400
 104 @@ -0,0 +1,2 @@
 105 +#! /bin/sh
 106 +[ -f $KERNEL_DIR/net/netfilter/xt_TARPIT.c ] && echo TARPIT