3 of 3 for patch-o-matic-ng
PATCH 1/1 3 of 3 for patch-o-matic-ng
This match filter is an extension of the ideas in FUZZY, though it is a complete rewrite. It matches at a linearly increasing rate if the number of packets per second from an specific IP address exceed a proscribed minimum value. I use this filter to limit traffic from ICMP type viruses to a few packets per second.
Signature · 2 lines
Tim Gardner - [email protected] www.tpi.com 406-443-5357
fuzzyp/help +15 -0
@@ -0,0 +1,15 @@ +This filter adds fuzzy packet limits based on source or destination IP addresses. +It embraces and extends the ideas put forth in ipt_fuzzy.c. + +Examples: + +# Limit any single IP address to at most 100 packets per second with +# linearly increasing packet loss between 50 and 100 packets per second. + +iptables -A FORWARD -m fuzzyp --fuzzyp-lower-limit 50 --fuzzyp-upper-limit 100 --fuzzyp-mode src-ip --fuzzyp-mask-bits 32 -j DROP + +# Limit all packets destined for a class C subnet to at most 100 packets per second. +iptables -A FORWARD -m fuzzyp --fuzzyp-lower-limit 50 --fuzzyp-upper-limit 100 --fuzzyp-mode dst-ip --fuzzyp-mask-bits 24 -j DRO +P + +
fuzzyp/info +6 -0
@@ -0,0 +1,6 @@ +Author: Tim Gardner <[email protected]> +Status: Stable +Repository: extra +Depends: hash +Recompile: netfilter +Recompile: iptables
fuzzyp/iptables/extensions/.fuzzyp-test +2 -0
@@ -0,0 +1,2 @@ +#! /bin/sh +[ -e $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_fuzzyp.h ] && echo fuzzyp
fuzzyp/iptables/extensions/libipt_fuzzyp.c +226 -0
226 lines not on this page · raw message
fuzzyp/iptables/extensions/libipt_fuzzyp.man +2 -0
@@ -0,0 +1,2 @@ +This filter target is used to limit the number of packets per +second from any single IP address.
fuzzyp/linux/include/linux/netfilter_ipv4/ipt_fuzzyp.h +33 -0
@@ -0,0 +1,33 @@ +#ifndef _IPT_FUZZYP_H +#define _IPT_FUZZYP_H + +#include <linux/param.h> +#include <linux/types.h> + +#define MAX_FUZZYP_RATE 10000000 +#define MIN_FUZZYP_RATE 3 +#define DEF_MIN_FUZZYP_RATE 1000 +#define DEF_MAX_FUZZYP_RATE 2000 + +#define FUZZYP_MAX_HASH_LEN 4096 + +struct fzp ; +enum ipt_fuzzyp_mode { + fzp_src_ip, + fzp_dst_ip +}; + +struct ipt_fuzzyp_info +{ +u_int32_t minimum_rate; +u_int32_t maximum_rate; +u_int32_t mask_bits; +enum ipt_fuzzyp_mode mode; + +/* +* Kernel stuff. +*/ +struct fzp *fzp_state; +}; + +#endif /*_IPT_FUZZYP_H*/
fuzzyp/linux/net/ipv4/netfilter/Config.in.ladd +2 -0
@@ -0,0 +1,2 @@ + dep_tristate ' Packet type match support' CONFIG_IP_NF_MATCH_PKTTYPE $CONFIG_IP_NF_IPTABLES + dep_tristate ' Fuzzy Plus filter support.' CONFIG_IP_NF_FUZZYP $CONFIG_IP_NF_HASH
fuzzyp/linux/net/ipv4/netfilter/ipt_fuzzyp.c +573 -0
573 lines not on this page · raw message
fuzzyp/linux/net/ipv4/netfilter/Kconfig.ladd +6 -0
@@ -0,0 +1,6 @@ + +config IP_NF_FUZZYP + tristate "Fuzzy Plus match filter support" + help + This filter drops packets on a sliding scale when the packet + rate exceeds a specified minimum rate.
fuzzyp/linux/net/ipv4/netfilter/Makefile.ladd +2 -0
@@ -0,0 +1,2 @@ +obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o +obj-$(CONFIG_IP_NF_FUZZYP) += ipt_fuzzyp.o