package/iptables/patches/08-chaostables.patch

   1 diff -ruN iptables-1.3.5.orig/extensions/.CHAOS-test iptables-1.3.5/extensions/.CHAOS-test
   2 --- iptables-1.3.5.orig/extensions/.CHAOS-test  1970-01-01 01:00:00.000000000 +0100
   3 +++ iptables-1.3.5/extensions/.CHAOS-test       2007-01-09 16:05:23.251885840 +0100
   4 @@ -0,0 +1,2 @@
   5 +#!/bin/sh
   6 +[ -f "$KERNEL_DIR/include/linux/netfilter/xt_CHAOS.h" ] && echo "CHAOS";
   7 diff -ruN iptables-1.3.5.orig/extensions/.DELUDE-test iptables-1.3.5/extensions/.DELUDE-test
   8 --- iptables-1.3.5.orig/extensions/.DELUDE-test 1970-01-01 01:00:00.000000000 +0100
   9 +++ iptables-1.3.5/extensions/.DELUDE-test      2007-01-09 16:05:18.104057722 +0100
  10 @@ -0,0 +1,2 @@
  11 +#!/bin/sh
  12 +echo "DELUDE";
  13 diff -ruN iptables-1.3.5.orig/extensions/libipt_CHAOS.c iptables-1.3.5/extensions/libipt_CHAOS.c
  14 --- iptables-1.3.5.orig/extensions/libipt_CHAOS.c       1970-01-01 01:00:00.000000000 +0100
  15 +++ iptables-1.3.5/extensions/libipt_CHAOS.c    2007-01-09 16:05:23.251885840 +0100
  16 @@ -0,0 +1,111 @@
  17 +/*
  18 +    CHAOS target for iptables
  19 +
  20 +    Copyright © Jan Engelhardt <jengelh [at] gmx de>, 2006 - 2007
  21 +    released under the terms of the GNU General Public
  22 +    License version 2.x and only versions 2.x.
  23 +*/
  24 +#include <getopt.h>
  25 +#include <stdio.h>
  26 +#include <string.h>
  27 +
  28 +#include <iptables.h>
  29 +#include <linux/netfilter_ipv4/ip_tables.h>
  30 +#include <linux/netfilter/xt_CHAOS.h>
  31 +
  32 +static void libipt_chaos_help(void)
  33 +{
  34 +       printf(
  35 +               "CHAOS target v%s options:\n"
  36 +               "  --delude     Enable DELUDE processing for TCP\n"
  37 +               "  --tarpit     Enable TARPIT processing for TCP\n",
  38 +               IPTABLES_VERSION);
  39 +       return;
  40 +}
  41 +
  42 +static int libipt_chaos_parse(int c, char **argv, int invert,
  43 +    unsigned int *flags, const struct ipt_entry *entry,
  44 +    struct ipt_entry_target **target)
  45 +{
  46 +       struct xt_chaos_info *info = (void *)((*target)->data);
  47 +       switch(c) {
  48 +               case 'd':
  49 +                       info->variant = XTCHAOS_DELUDE;
  50 +                       *flags |= 0x02;
  51 +                       return 1;
  52 +               case 't':
  53 +                       info->variant = XTCHAOS_TARPIT;
  54 +                       *flags |= 0x01;
  55 +                       return 1;
  56 +       }
  57 +       return 0;
  58 +}
  59 +
  60 +static void libipt_chaos_check(unsigned int flags)
  61 +{
  62 +       if(flags != 0x03)
  63 +               return;
  64 +       /* If flags == 0x03, both were specified, which should not be. */
  65 +       exit_error(PARAMETER_PROBLEM,
  66 +                  "CHAOS: only one of --tarpit or --delude may be specified");
  67 +       return;
  68 +}
  69 +
  70 +static void libipt_chaos_print(const struct ipt_ip *ip,
  71 +    const struct ipt_entry_target *target, int numeric)
  72 +{
  73 +       const struct xt_chaos_info *info = (const void *)target->data;
  74 +       switch(info->variant) {
  75 +               case XTCHAOS_DELUDE:
  76 +                       printf("DELUDE ");
  77 +                       break;
  78 +               case XTCHAOS_TARPIT:
  79 +                       printf("TARPIT ");
  80 +                       break;
  81 +               default:
  82 +                       break;
  83 +       }
  84 +       return;
  85 +}
  86 +
  87 +static void libipt_chaos_save(const struct ipt_ip *ip,
  88 +    const struct ipt_entry_target *target)
  89 +{
  90 +       const struct xt_chaos_info *info = (const void *)target->data;
  91 +       switch(info->variant) {
  92 +               case XTCHAOS_DELUDE:
  93 +                       printf("--delude ");
  94 +                       break;
  95 +               case XTCHAOS_TARPIT:
  96 +                       printf("--tarpit ");
  97 +                       break;
  98 +               default:
  99 +                       break;
 100 +       }
 101 +       return;
 102 +}
 103 +
 104 +static struct option libipt_chaos_opts[] = {
 105 +       {"delude", 0, NULL, 'd'},
 106 +       {"tarpit", 0, NULL, 't'},
 107 +       {NULL},
 108 +};
 109 +
 110 +static struct iptables_target libipt_chaos_info = {
 111 +       .name          = "CHAOS",
 112 +       .version       = IPTABLES_VERSION,
 113 +       .size          = IPT_ALIGN(sizeof(struct xt_chaos_info)),
 114 +       .userspacesize = IPT_ALIGN(sizeof(struct xt_chaos_info)),
 115 +       .help          = libipt_chaos_help,
 116 +       .parse         = libipt_chaos_parse,
 117 +       .final_check   = libipt_chaos_check,
 118 +       .print         = libipt_chaos_print,
 119 +       .save          = libipt_chaos_save,
 120 +       .extra_opts    = libipt_chaos_opts,
 121 +};
 122 +
 123 +static __attribute__((constructor)) void libipt_chaos_init(void)
 124 +{
 125 +       register_target(&libipt_chaos_info);
 126 +       return;
 127 +}
 128 diff -ruN iptables-1.3.5.orig/extensions/libipt_DELUDE.c iptables-1.3.5/extensions/libipt_DELUDE.c
 129 --- iptables-1.3.5.orig/extensions/libipt_DELUDE.c      1970-01-01 01:00:00.000000000 +0100
 130 +++ iptables-1.3.5/extensions/libipt_DELUDE.c   2007-01-09 16:05:18.104057722 +0100
 131 @@ -0,0 +1,66 @@
 132 +/*
 133 +    DELUDE target for iptables
 134 +
 135 +    Copyright © Jan Engelhardt <jengelh [at] gmx de>, 2006 - 2007
 136 +    released under the terms of the GNU General Public
 137 +    License version 2.x and only versions 2.x.
 138 +*/
 139 +#include <getopt.h>
 140 +#include <stdio.h>
 141 +#include <string.h>
 142 +
 143 +#include <iptables.h>
 144 +#include <linux/netfilter_ipv4/ip_tables.h>
 145 +
 146 +static void libipt_delude_help(void)
 147 +{
 148 +       printf("DELUDE takes no options\n");
 149 +       return;
 150 +}
 151 +
 152 +static int libipt_delude_parse(int c, char **argv, int invert,
 153 +    unsigned int *flags, const struct ipt_entry *entry,
 154 +    struct ipt_entry_target **target)
 155 +{
 156 +       return 0;
 157 +}
 158 +
 159 +static void libipt_delude_check(unsigned int flags)
 160 +{
 161 +       return;
 162 +}
 163 +
 164 +static void libipt_delude_print(const struct ipt_ip *ip,
 165 +    const struct ipt_entry_target *target, int numeric)
 166 +{
 167 +       return;
 168 +}
 169 +
 170 +static void libipt_delude_save(const struct ipt_ip *ip,
 171 +    const struct ipt_entry_target *target)
 172 +{
 173 +       return;
 174 +}
 175 +
 176 +static struct option libipt_delude_opts[] = {
 177 +       {NULL},
 178 +};
 179 +
 180 +static struct iptables_target libipt_delude_info = {
 181 +       .name          = "DELUDE",
 182 +       .version       = IPTABLES_VERSION,
 183 +       .size          = IPT_ALIGN(0),
 184 +       .userspacesize = IPT_ALIGN(0),
 185 +       .help          = libipt_delude_help,
 186 +       .parse         = libipt_delude_parse,
 187 +       .final_check   = libipt_delude_check,
 188 +       .print         = libipt_delude_print,
 189 +       .save          = libipt_delude_save,
 190 +       .extra_opts    = libipt_delude_opts,
 191 +};
 192 +
 193 +static __attribute__((constructor)) void libipt_delude_init(void)
 194 +{
 195 +       register_target(&libipt_delude_info);
 196 +       return;
 197 +}
 198 diff -ruN iptables-1.3.5.orig/extensions/libipt_portscan.c iptables-1.3.5/extensions/libipt_portscan.c
 199 --- iptables-1.3.5.orig/extensions/libipt_portscan.c    1970-01-01 01:00:00.000000000 +0100
 200 +++ iptables-1.3.5/extensions/libipt_portscan.c 2007-01-09 16:05:14.228187134 +0100
 201 @@ -0,0 +1,129 @@
 202 +/*
 203 +    portscan match for iptables
 204 +
 205 +    Copyright © Jan Engelhardt <jengelh [at] gmx de>, 2006 - 2007
 206 +    released under the terms of the GNU General Public
 207 +    License version 2.x and only versions 2.x.
 208 +*/
 209 +#include <stdio.h>
 210 +#include <string.h>
 211 +#include <stdlib.h>
 212 +#include <getopt.h>
 213 +
 214 +#include <iptables.h>
 215 +#include <linux/netfilter_ipv4/ip_tables.h>
 216 +#include <linux/netfilter/xt_portscan.h>
 217 +
 218 +static void libipt_portscan_help(void)
 219 +{
 220 +       printf(
 221 +               "portscan match v%s options:\n"
 222 +               "(Combining them will make them match by OR-logic)\n"
 223 +               "  --stealth    Match TCP Stealth packets\n"
 224 +               "  --synscan    Match TCP SYN scans\n"
 225 +               "  --cnscan     Match TCP Connect scans\n"
 226 +               "  --grscan     Match Banner Grabbing scans\n",
 227 +               IPTABLES_VERSION);
 228 +       return;
 229 +}
 230 +
 231 +static void libipt_portscan_mtinit(struct ipt_entry_match *match,
 232 +    unsigned int *nfcache)
 233 +{
 234 +       /* Cannot cache this */
 235 +       *nfcache |= NFC_UNKNOWN;
 236 +       return;
 237 +}
 238 +
 239 +static int libipt_portscan_parse(int c, char **argv, int invert,
 240 +    unsigned int *flags, const struct ipt_entry *entry, unsigned int *nfc,
 241 +    struct ipt_entry_match **match)
 242 +{
 243 +       struct xt_portscan_info *info = (void *)((*match)->data);
 244 +
 245 +       switch(c) {
 246 +               case 'c':
 247 +                       info->match_cn = 1;
 248 +                       return 1;
 249 +               case 'g':
 250 +                       info->match_gr = 1;
 251 +                       return 1;
 252 +               case 's':
 253 +                       info->match_syn = 1;
 254 +                       return 1;
 255 +               case 'x':
 256 +                       info->match_stealth = 1;
 257 +                       return 1;
 258 +               default:
 259 +                       return 0;
 260 +       }
 261 +}
 262 +
 263 +static void libipt_portscan_check(unsigned int flags)
 264 +{
 265 +       return;
 266 +}
 267 +
 268 +static void libipt_portscan_print(const struct ipt_ip *ip,
 269 +    const struct ipt_entry_match *match, int numeric)
 270 +{
 271 +       const struct xt_portscan_info *info = (const void *)(match->data);
 272 +       const char *s = "";
 273 +
 274 +       printf("portscan ");
 275 +       if(info->match_stealth) {
 276 +               printf("STEALTH");
 277 +               s = ",";
 278 +       }
 279 +       if(info->match_syn) {
 280 +               printf("%sSYNSCAN", s);
 281 +               s = ",";
 282 +       }
 283 +       if(info->match_cn) {
 284 +               printf("%sCNSCAN", s);
 285 +               s = ",";
 286 +       }
 287 +       if(info->match_gr)
 288 +               printf("%sGRSCAN", s);
 289 +       printf(" ");
 290 +       return;
 291 +}
 292 +
 293 +static void libipt_portscan_save(const struct ipt_ip *ip,
 294 +    const struct ipt_entry_match *match)
 295 +{
 296 +       const struct xt_portscan_info *info = (const void *)(match->data);
 297 +       if(info->match_stealth) printf("--stealth ");
 298 +       if(info->match_syn)     printf("--synscan ");
 299 +       if(info->match_cn)      printf("--cnscan ");
 300 +       if(info->match_gr)      printf("--grscan ");
 301 +       return;
 302 +}
 303 +
 304 +static struct option libipt_portscan_opts[] = {
 305 +       {"stealth", 0, NULL, 'x'},
 306 +       {"synscan", 0, NULL, 's'},
 307 +       {"cnscan",  0, NULL, 'c'},
 308 +       {"grscan",  0, NULL, 'g'},
 309 +       {NULL},
 310 +};
 311 +
 312 +static struct iptables_match libipt_portscan_info = {
 313 +       .name          = "portscan",
 314 +       .version       = IPTABLES_VERSION,
 315 +       .size          = IPT_ALIGN(sizeof(struct xt_portscan_info)),
 316 +       .userspacesize = IPT_ALIGN(sizeof(struct xt_portscan_info)),
 317 +       .help          = libipt_portscan_help,
 318 +       .init          = libipt_portscan_mtinit,
 319 +       .parse         = libipt_portscan_parse,
 320 +       .final_check   = libipt_portscan_check,
 321 +       .print         = libipt_portscan_print,
 322 +       .save          = libipt_portscan_save,
 323 +       .extra_opts    = libipt_portscan_opts,
 324 +};
 325 +
 326 +static __attribute__((constructor)) void libipt_portscan_init(void)
 327 +{
 328 +       register_match(&libipt_portscan_info);
 329 +       return;
 330 +}
 331 diff -ruN iptables-1.3.5.orig/extensions/.portscan-test iptables-1.3.5/extensions/.portscan-test
 332 --- iptables-1.3.5.orig/extensions/.portscan-test       1970-01-01 01:00:00.000000000 +0100
 333 +++ iptables-1.3.5/extensions/.portscan-test    2007-01-09 16:05:14.228187134 +0100
 334 @@ -0,0 +1,2 @@
 335 +#!/bin/sh
 336 +[ -f "$KERNEL_DIR/include/linux/netfilter/xt_portscan.h" ] && echo "portscan";