Public feed #727075

netfilter xt_TARPIT

public diff v1 · immutable
Raw Edit
·published 2007-10-05 19:00 UTC
rendered paste body
Index: include/netfilter.mk===================================================================--- include/netfilter.mk	(revision 9141)+++ include/netfilter.mk	(working copy)@@ -1,4 +1,4 @@-# +# # Copyright (C) 2006 OpenWrt.org # # This is free software, licensed under the GNU General Public License v2.@@ -60,6 +60,7 @@ #$(eval $(call nf_add,IPT_EXTRA,CONFIG_IP_NF_MATCH_QUOTA, $(P_V4)ipt_quota)) $(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_MATCH_QUOTA, $(P_XT)xt_quota)) +$(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_TARGET_TARPIT, $(P_XT)xt_TARPIT)) $(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_TARGET_CHAOS, $(P_XT)xt_CHAOS)) $(eval $(call nf_add,IPT_EXTRA,CONFIG_NETFILTER_XT_TARGET_DELUDE, $(P_XT)xt_DELUDE)) $(eval $(call nf_add,IPT_EXTRA,CONFIG_IP_NF_TARGET_LOG, $(P_V4)ipt_LOG))Index: target/linux/generic-2.6/config-2.6.22===================================================================--- target/linux/generic-2.6/config-2.6.22	(revision 9141)+++ target/linux/generic-2.6/config-2.6.22	(working copy)@@ -745,6 +745,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m CONFIG_NETFILTER_XT_TARGET_NOTRACK=m+CONFIG_NETFILTER_XT_TARGET_TARPIT=m CONFIG_NETFILTER_XT_TARGET_TCPMSS=y # CONFIG_NETPOLL is not set # CONFIG_NETROM is not setIndex: target/linux/generic-2.6/patches-2.6.22/171-netfilter_tarpit.patch===================================================================--- target/linux/generic-2.6/patches-2.6.22/171-netfilter_tarpit.patch	(revision 0)+++ target/linux/generic-2.6/patches-2.6.22/171-netfilter_tarpit.patch	(revision 0)@@ -0,0 +1,325 @@+Index: linux-2.6.22.4/net/netfilter/Kconfig+===================================================================+--- linux-2.6.22.4.orig/net/netfilter/Kconfig++++ linux-2.6.22.4/net/netfilter/Kconfig+@@ -379,6 +379,23 @@ config NETFILTER_XT_TARGET_CONNSECMARK+ + 	  To compile it as a module, choose M here.  If unsure, say N.+ ++config NETFILTER_XT_TARGET_TARPIT++	tristate '"TARPIT" target support'++	depends on NETFILTER_XTABLES++	---help---++	  Adds a TARPIT target to iptables, which captures and holds++	  incoming TCP connections using no local per-connection resources.++	  Connections are accepted, but immediately switched to the persist++	  state (0 byte window), in which the remote side stops sending data++	  and asks to continue every 60-240 seconds. Attempts to close the++	  connection are ignored, forcing the remote side to time out the++	  connection in 12-24 minutes.++++	  This offers similar functionality to LaBrea++	  <http://www.hackbusters.net/LaBrea/>, but does not require dedicated++	  hardware or IPs. Any TCP port that you would normally DROP or REJECT++	  can instead become a tarpit.+++ config NETFILTER_XT_TARGET_TCPMSS+ 	tristate '"TCPMSS" target support'+ 	depends on NETFILTER_XTABLES && (IPV6 || IPV6=n)+Index: linux-2.6.22.4/net/netfilter/Makefile+===================================================================+--- linux-2.6.22.4.orig/net/netfilter/Makefile++++ linux-2.6.22.4/net/netfilter/Makefile+@@ -47,6 +47,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE+ obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o+ obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o+ obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o++obj-$(CONFIG_NETFILTER_XT_TARGET_TARPIT) += xt_TARPIT.o+ obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o+ obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o+ +Index: linux-2.6.22.4/net/netfilter/xt_TARPIT.c+===================================================================+--- /dev/null++++ linux-2.6.22.4/net/netfilter/xt_TARPIT.c+@@ -0,0 +1,280 @@++/*++ * Kernel module to capture and hold incoming TCP connections using++ * no local per-connection resources.++ *++ * Based on ipt_REJECT.c and offering functionality similar to++ * LaBrea <http://www.hackbusters.net/LaBrea/>.++ *++ * Copyright (c) 2002 Aaron Hopkins <tools@die.net>++ *++ * This program is free software; you can redistribute it and/or modify++ * it under the terms of the GNU General Public License as published by++ * the Free Software Foundation; either version 2 of the License, or++ * (at your option) any later version.++ *++ * This program is distributed in the hope that it will be useful,++ * but WITHOUT ANY WARRANTY; without even the implied warranty of++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the++ * GNU General Public License for more details.++ *++ * You should have received a copy of the GNU General Public License++ * along with this program; if not, write to the Free Software++ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.++ *++ * Goal:++ * - Allow incoming TCP connections to be established.++ * - Passing data should result in the connection being switched to the++ *   persist state (0 byte window), in which the remote side stops sending++ *   data and asks to continue every 60 seconds.++ * - Attempts to shut down the connection should be ignored completely, so++ *   the remote side ends up having to time it out.++ *++ * This means:++ * - Reply to TCP SYN,!ACK,!RST,!FIN with SYN-ACK, window 5 bytes++ * - Reply to TCP SYN,ACK,!RST,!FIN with RST to prevent spoofing++ * - Reply to TCP !SYN,!RST,!FIN with ACK, window 0 bytes, rate-limited++ */++++#include <linux/version.h>++#include <linux/module.h>++#include <linux/skbuff.h>++#include <linux/ip.h>++#include <net/ip.h>++#include <net/tcp.h>++#include <net/icmp.h>++struct in_device;++#include <net/route.h>++#include <linux/random.h>++#include <linux/netfilter_ipv4/ip_tables.h>++++#if 0++#define DEBUGP printk++#else++#define DEBUGP(format, args...)++#endif++++/* Stolen from ip_finish_output2 */++static int ip_direct_send(struct sk_buff *skb)++{++	struct dst_entry *dst = skb->dst;++++        if (dst->hh != NULL)++		return neigh_hh_output(dst->hh, skb);++	else if (dst->neighbour != NULL)++		return dst->neighbour->output(skb);++++	if (net_ratelimit())++		printk(KERN_DEBUG "TARPIT ip_direct_send: no header cache and no neighbor!\n");++++	kfree_skb(skb);++	return -EINVAL;++}++++++/* Send reply */++static void tarpit_tcp(const struct sk_buff *oskb, struct rtable *ort,++                       unsigned int local)++{++	struct sk_buff *nskb;++	struct rtable *nrt;++	struct tcphdr *otcph, *ntcph;++	struct flowi fl = {};++	unsigned int otcplen;++	u_int16_t tmp;++++	const struct iphdr *oiph = ip_hdr(oskb);++	struct iphdr *niph;++++	/* A truncated TCP header is not going to be useful */++	if (oskb->len < ip_hdrlen(oskb) + sizeof(struct tcphdr))++		return;++++	otcph   = (void *)oiph + ip_hdrlen(oskb);++	otcplen = oskb->len - ip_hdrlen(oskb);++++	/* No replies for RST or FIN */++	if (otcph->rst || otcph->fin)++		return;++++	/* No reply to !SYN,!ACK.  Rate-limit replies to !SYN,ACKs */++	if (!otcph->syn && (!otcph->ack || !xrlim_allow(&ort->u.dst, 1*HZ)))++		return;++++	/* Check checksum. */++	if (tcp_v4_check(otcplen, oiph->saddr, oiph->daddr,++	    csum_partial((char *)otcph, otcplen, 0)) != 0)++		return;++++	/*++	 * Copy skb (even if skb is about to be dropped, we cannot just++	 * clone it because there may be other things, such as tcpdump,++	 * interested in it)++	 */++	nskb = skb_copy(oskb, GFP_ATOMIC);++	if (nskb == NULL)++		return;++++	niph = ip_hdr(nskb);++++	/* This packet will not be the same as the other: clear nf fields */++	nf_conntrack_put(nskb->nfct);++	nskb->nfct = NULL;++#ifdef CONFIG_NETFILTER_DEBUG++	nskb->nf_debug = 0;++#endif++++	ntcph = (void *)niph + ip_hdrlen(nskb);++++	/* Truncate to length (no data) */++	ntcph->doff = sizeof(struct tcphdr)/4;++	skb_trim(nskb, ip_hdrlen(nskb) + sizeof(struct tcphdr));++	niph->tot_len = htons(nskb->len);++++	/* Swap source and dest */++	niph->daddr = xchg(&niph->saddr, niph->daddr);++	tmp = ntcph->source;++	ntcph->source = ntcph->dest;++	ntcph->dest = tmp;++++	/* Use supplied sequence number or make a new one */++	ntcph->seq = otcph->ack ? otcph->ack_seq++		: htonl(secure_tcp_sequence_number(niph->saddr,++						   niph->daddr,++						   ntcph->source,++						   ntcph->dest));++++	/* Our SYN-ACKs must have a >0 window */++	ntcph->window = (otcph->syn && !otcph->ack) ? htons(5) : 0;++++	ntcph->urg_ptr = 0;++++	/* Reset flags */++	((u_int8_t *)ntcph)[13] = 0;++++	if (otcph->syn && otcph->ack) {++		ntcph->rst = 1;++		ntcph->ack_seq = 0;++	} else {++		ntcph->syn = otcph->syn;++		ntcph->ack = 1;++		ntcph->ack_seq = htonl(ntohl(otcph->seq) + otcph->syn);++	}++++	/* Adjust TCP checksum */++	ntcph->check = 0;++	ntcph->check = tcp_v4_check(sizeof(struct tcphdr),++				   niph->saddr,++				   niph->daddr,++				   csum_partial((char *)ntcph,++						sizeof(struct tcphdr), 0));++++	fl.nl_u.ip4_u.daddr = niph->daddr;++	fl.nl_u.ip4_u.saddr = local ? niph->saddr : 0;++	fl.nl_u.ip4_u.tos = RT_TOS(niph->tos) | RTO_CONN;++	fl.oif = 0;++++	if (ip_route_output_key(&nrt, &fl))++		goto free_nskb;++++	dst_release(nskb->dst);++	nskb->dst = &nrt->u.dst;++++	/* Adjust IP TTL */++	niph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);++++	/* Set DF, id = 0 */++	niph->frag_off = htons(IP_DF);++	niph->id = 0;++++	/* Adjust IP checksum */++	niph->check = 0;++	niph->check = ip_fast_csum((unsigned char *)niph, niph->ihl);++++	/* "Never happens" */++	if (nskb->len > dst_mtu(nskb->dst))++		goto free_nskb;++++	ip_direct_send(nskb);++	return;++++ free_nskb:++	kfree_skb(nskb);++}++++static unsigned int xt_tarpit_target(struct sk_buff **pskb,++                                     const struct net_device *in,++                                     const struct net_device *out,++                                     unsigned int hooknum,++                                     const struct xt_target *target,++                                     const void *targinfo)++{++	const struct sk_buff *skb = *pskb;++	const struct iphdr *iph   = ip_hdr(skb);++	struct rtable *rt         = (void *)skb->dst;++++	/* Do we have an input route cache entry? */++	if (rt == NULL)++		return NF_DROP;++++	/* No replies to physical multicast/broadcast */++	if (skb->pkt_type != PACKET_HOST && skb->pkt_type != PACKET_OTHERHOST)++		return NF_DROP;++++	/* Now check at the protocol level */++	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))++		return NF_DROP;++++	/*++	 * Our naive response construction does not deal with IP++	 * options, and probably should not try.++	 */++	if (iph->ihl * 4 != sizeof(struct iphdr))++		return NF_DROP;++++	/* We are not interested in fragments */++	if (iph->frag_off & htons(IP_OFFSET))++		return NF_DROP;++++	tarpit_tcp(skb, rt, hooknum == NF_IP_LOCAL_IN);++	return NF_DROP;++}++++static bool xt_tarpit_check(const char *tablename, const void *entry,++                            const struct xt_target *target, void *targinfo,++                            unsigned int hook_mask)++{++	bool invalid;++++	if (strcmp(tablename, "raw") == 0 && hook_mask == NF_IP_PRE_ROUTING)++		return true;++	if (strcmp(tablename, "filter") != 0)++		return false;++	invalid = hook_mask & ~((1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD));++	return !invalid;++}++++static struct xt_target xt_tarpit_reg = {++	.name       = "TARPIT",++	.family     = AF_INET,++	.proto      = IPPROTO_TCP,++	.target     = xt_tarpit_target,++	.checkentry = xt_tarpit_check,++	.me         = THIS_MODULE,++};++++static int __init xt_tarpit_init(void)++{++	return xt_register_target(&xt_tarpit_reg);++}++++static void __exit xt_tarpit_exit(void)++{++	xt_unregister_target(&xt_tarpit_reg);++}++++module_init(xt_tarpit_init);++module_exit(xt_tarpit_exit);++MODULE_DESCRIPTION("netfilter xt_TARPIT target module");++MODULE_AUTHOR("Jan Engelhardt <jengelh@gmx.de>");++MODULE_LICENSE("GPL");++MODULE_ALIAS("ipt_TARPIT");Index: package/iptables/patches/009-tarpit-support.patch===================================================================--- package/iptables/patches/009-tarpit-support.patch	(revision 0)+++ package/iptables/patches/009-tarpit-support.patch	(revision 0)@@ -0,0 +1,106 @@+diff -N -u -r iptables-1.3.8-20070817/extensions/libipt_TARPIT.c iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.c+--- iptables-1.3.8-20070817/extensions/libipt_TARPIT.c	1969-12-31 19:00:00.000000000 -0500++++ iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.c	2007-08-18 14:49:25.000000000 -0400+@@ -0,0 +1,58 @@++/* Shared library add-on to iptables for TARPIT support */++#include <stdio.h>++#include <getopt.h>++#include <iptables.h>++++static void++help(void)++{++	fputs(++"TARPIT takes no options\n"++"\n", stdout);++}++++static struct option opts[] = {++	{ 0 }++};++++static int++parse(int c, char **argv, int invert, unsigned int *flags,++      const struct ipt_entry *entry,++      struct ipt_entry_target **target)++{++	return 0;++}++++static void final_check(unsigned int flags)++{++}++++static void++print(const struct ipt_ip *ip,++      const struct ipt_entry_target *target,++      int numeric)++{++}++++static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)++{++}++++static struct iptables_target tarpit = {++	.next		= NULL,++	.name		= "TARPIT",++	.version	= IPTABLES_VERSION,++	.size		= IPT_ALIGN(0),++	.userspacesize	= IPT_ALIGN(0),++	.help		= &help,++	.parse		= &parse,++	.final_check	= &final_check,++	.print		= &print,++	.save		= &save,++	.extra_opts	= opts++};++++void _init(void)++{++	register_target(&tarpit);++}+diff -N -u -r iptables-1.3.8-20070817/extensions/libipt_TARPIT.man iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.man+--- iptables-1.3.8-20070817/extensions/libipt_TARPIT.man	1969-12-31 19:00:00.000000000 -0500++++ iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.man	2007-08-18 14:49:25.000000000 -0400+@@ -0,0 +1,34 @@++Captures and holds incoming TCP connections using no local++per-connection resources. Connections are accepted, but immediately++switched to the persist state (0 byte window), in which the remote++side stops sending data and asks to continue every 60-240 seconds.++Attempts to close the connection are ignored, forcing the remote side++to time out the connection in 12-24 minutes.++++This offers similar functionality to LaBrea++<http://www.hackbusters.net/LaBrea/> but doesn't require dedicated++hardware or IPs. Any TCP port that you would normally DROP or REJECT++can instead become a tarpit.++++To tarpit connections to TCP port 80 destined for the current machine:++.IP++iptables -A INPUT -p tcp -m tcp --dport 80 -j TARPIT++.P++To significantly slow down Code Red/Nimda-style scans of unused address++space, forward unused ip addresses to a Linux box not acting as a router++(e.g. "ip route 10.0.0.0 255.0.0.0 ip.of.linux.box" on a Cisco), enable IP++forwarding on the Linux box, and add:++.IP++iptables -A FORWARD -p tcp -j TARPIT++.IP++iptables -A FORWARD -j DROP++.TP++NOTE:++If you use the conntrack module while you are using TARPIT, you should++also use the NOTRACK target, or the kernel will unnecessarily allocate++resources for each TARPITted connection. To TARPIT incoming++connections to the standard IRC port while using conntrack, you could:++.IP++iptables -t raw -A PREROUTING -p tcp --dport 6667 -j NOTRACK++.IP++iptables -A INPUT -p tcp --dport 6667 -j TARPIT+diff -N -u -r iptables-1.3.8-20070817/extensions/.TARPIT-test iptables-1.3.8-20070817-nf/extensions/.TARPIT-test+--- iptables-1.3.8-20070817/extensions/.TARPIT-test	1969-12-31 19:00:00.000000000 -0500++++ iptables-1.3.8-20070817-nf/extensions/.TARPIT-test	2007-08-18 14:49:25.000000000 -0400+@@ -0,0 +1,2 @@++#! /bin/sh++[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_TARPIT.c ] && echo TARPIT