Skip to contentSkip to conversation

Tarpit target for the last stable (2.6.35.7): right version

PATCH In review Nicola 4 participants 4 messages Oct 8, 2010 – Oct 9, 2010

Subsystems (4)
Networking Network drivers netfilter Random number driver
lore
Share & tools
lore

Nicola

author
#0 lore raw

PATCH 1/1 Tarpit target for the last stable (2.6.35.7): right version

[Sorry for the inconvenience: I just noticed that Gmail has a bad formatting. I resend the patch hoping that now things are right.]

Kernel module to capture and hold incoming TCP connections sending a zero window packet to slow down the worm action.
More informations and newer version at:
http://npadovano.altervista.org/tarpit.html (or in the source code comments)
Below you can find the patch and the relative userspace library (compile it and put the .so output in /lib/xtables)

----tarpit-2.6.35.7.patch----

drivers/char/random.c 2010-10-08 02:51:35.000000000 +0200 renamed from drivers/char/random.c 2010-09-29 03:09:08.000000000 +0200 +4 -0
diff -rupN linux-2.6.35.7.orig/drivers/char/random.c linux-2.6.35.7/drivers/char/random.c
@@ -1514,6 +1514,8 @@ __u32 secure_ip_id(__be32 daddr)
     return half_md4_transform(hash, keyptr->secret);
 }
 
+EXPORT_SYMBOL(secure_ip_id);
+
 #ifdef CONFIG_INET
 
 __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,

@@ -1551,6 +1553,8 @@ __u32 secure_tcp_sequence_number(__be32
     return seq;
 }
 
+EXPORT_SYMBOL(secure_tcp_sequence_number);
+
 /* Generate secure starting point for ephemeral IPV4 transport port

search */
u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport) {

net/netfilter/Kconfig 2010-10-08 12:51:07.000000000 +0200 renamed from net/netfilter/Kconfig 2010-09-29 03:09:08.000000000 +0200 +26 -0
diff -rupN linux-2.6.35.7.orig/net/netfilter/Kconfig linux-2.6.35.7/net/netfilter/Kconfig
@@ -548,6 +548,32 @@ config NETFILTER_XT_TARGET_SECMARK
 
       To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_TARGET_TARPIT
+    tristate '"TARPIT" target support'
+    depends on NETFILTER_XTABLES
+    default m if NETFILTER_ADVANCED=n
+    ---help---
+      Adds a TARPIT target to iptables, which captures and holds
+      incoming TCP connections using no local per-connection resources.
+      Connections are accepted, but immediately switched to the persist
+      state (0 byte window), in which the remote side stops sending data
+      and asks to continue every 60-240 seconds (with a probe packet).
+      Attempts to close the connection are ignored, forcing the remote
+      side to time out the connection in 12-24 minutes. Any TCP port that
+      you would normally DROP or REJECT can instead become a tarpit.
+      Example:
+
+      1) iptables -A INPUT -p tcp --dport 1111 -j TARPIT
+      2) iptables -A FORWARD -p tcp -s x.y.z.k --dport 1111 -j TARPIT
+
+       In the first example all the incoming TCP packets sent to the port
+      1111 will be tarpitted. In the second one, we're tarpitting all the
+      forwarded packets sent to the host x.y.z.k on the port 1111.
+
+         You can find more informations and newer versions at:
+ <http://npadovano.altervista.org/tarpit.html>. Reporting bugs and
+      improvements are welcome.
+
 config NETFILTER_XT_TARGET_TCPMSS
     tristate '"TCPMSS" target support'
     depends on (IPV6 || IPV6=n)
net/netfilter/Makefile 2010-10-08 02:53:44.000000000 +0200 renamed from net/netfilter/Makefile 2010-09-29 03:09:08.000000000 +0200 +1 -0
diff -rupN linux-2.6.35.7.orig/net/netfilter/Makefile linux-2.6.35.7/net/netfilter/Makefile
@@ -56,6 +56,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE
 obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_RATEEST) += xt_RATEEST.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_TARPIT) += xt_TARPIT.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TPROXY) += xt_TPROXY.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP) += xt_TCPOPTSTRIP.o
net/netfilter/xt_TARPIT.c 2010-10-08 13:27:54.000000000 +0200 renamed from net/netfilter/xt_TARPIT.c 1970-01-01 01:00:00.000000000 +0100 +304 -0

304 lines not on this page · raw message

----libxt_TARPIT.c----
#include <stdio.h>
#include <getopt.h>
#include <xtables.h>

static void tarpit_tg_help(void)

{
       printf("TARPIT takes no options\n\n");
}

static int tarpit_tg_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_target
**target)

{
       return 0;
}

static void tarpit_tg_check(unsigned int flags)
{
}

static struct xtables_target tarpit_tg_reg = {

       .version       = XTABLES_VERSION,
       .name          = "TARPIT",
       .family        = AF_INET,
       .help          = tarpit_tg_help,
       .parse         = tarpit_tg_parse,
       .final_check   = tarpit_tg_check,

};

static __attribute__((constructor)) void tarpit_tg_ldr(void)

{
       xtables_register_target(&tarpit_tg_reg);
}
#1 lore raw
Quoted 2 lines · Nicola

[Sorry for the inconvenience: I just noticed that Gmail has a bad formatting. I resend the patch hoping that now things are right.]

[...]

It's still word-wrapped. You may have to make the patch an attachment, but see Documentation/email-clients.txt for configuration hints.

It is also not based on the right version; networking patches adding new features should be based on David Miller's net-next-2.6 tree.

You should also read and follow Documentation/SubmittingPatches.

Ben.

Signature · 3 lines
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
#2 lore raw
Quoted 10 lines · Ben Hutchings
Quoted 2 lines · Nicola

[Sorry for the inconvenience: I just noticed that Gmail has a bad formatting. I resend the patch hoping that now things are right.]

[...]

It's still word-wrapped. You may have to make the patch an attachment, but see Documentation/email-clients.txt for configuration hints.

It is also not based on the right version; networking patches adding new features should be based on David Miller's net-next-2.6 tree.

I must say I am surprised.

There already exists a maintained xt_TARPIT in Xtables-addons, and it seems like your patch is a duplicate effort of it.

If you have any updates to xt_TARPIT, I would recommend the strategy that Luciano Coelho used when he wanted to have xt_condition in the main kernel:

1. take the maintained version from Xt-a
2. submit any updates to the Xt-a file, if feasible
3. once processed, submit that then for Linux kernel inclusion
4. apply further updates to the LK file, if needed

That way it is way easier to know what specifically new features you have added to xt_TARPIT, if any.

thanks,
Jan

#3 lore raw
Quoted 9 lines · Jan Engelhardt

I must say I am surprised.

There already exists a maintained xt_TARPIT in Xtables-addons, and it seems like your patch is a duplicate effort of it.

If you have any updates to xt_TARPIT, I would recommend the strategy that Luciano Coelho used when he wanted to have xt_condition in the main kernel:

Quoted 8 lines

1. take the maintained version from Xt-a
2. submit any updates to the Xt-a file, if feasible
3. once processed, submit that then for Linux kernel inclusion
4. apply further updates to the LK file, if needed

That way it is way easier to know what specifically new features you have added to xt_TARPIT, if any.

Agreed, so much messages on netdev and netfilter-devel, only to rewrite a TARPIT module :-(

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html