anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-06 12:45:13 +02:00
Code Issues Releases Wiki Activity

TARPIT: move XTTARPIT_TARPIT mode processing to its own function

Browse Source 
Moves the XTTARPIT_TARPIT mode processing to its own function.

Signed-off-by: Josh Hunt <johunt@akamai.com>
This commit is contained in:
Josh Hunt
2012-07-08 11:11:20 -07:00
committed by Jan Engelhardt
parent d11218815f
commit cbe58f55d0
1 changed files with 28 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
extensions/xt_TARPIT.c
View File

@@ -51,6 +51,33 @@
#include "compat_xtables.h" #include "compat_xtables.h"
#include "xt_TARPIT.h" #include "xt_TARPIT.h"
static bool xttarpit_tarpit(struct tcphdr *tcph, const struct tcphdr *oth)
{
/* No replies for RST, FIN or !SYN,!ACK */
if (oth->rst || oth->fin || (!oth->syn && !oth->ack))
return false;
tcph->seq = oth->ack ? oth->ack_seq : 0;
/* Our SYN-ACKs must have a >0 window */
tcph->window = (oth->syn && !oth->ack) ? htons(5) : 0;
if (oth->syn && oth->ack) {
tcph->rst = true;
tcph->ack_seq = false;
} else {
tcph->syn = oth->syn;
tcph->ack = true;
tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn);
}
#if 0
/* Rate-limit replies to !SYN,ACKs */
if (!oth->syn && oth->ack)
if (!xrlim_allow(rt_dst(ort), HZ))
return false;
#endif
return true;
}
static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook, static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook,
unsigned int mode) unsigned int mode)
{ {
@@ -118,27 +145,8 @@ static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook,
((u_int8_t *)tcph)[13] = 0; ((u_int8_t *)tcph)[13] = 0;
if (mode == XTTARPIT_TARPIT) { if (mode == XTTARPIT_TARPIT) {
/* No replies for RST, FIN or !SYN,!ACK */ if (!xttarpit_tarpit(tcph, oth))
if (oth->rst || oth->fin || (!oth->syn && !oth->ack))
return; return;
tcph->seq = oth->ack ? oth->ack_seq : 0;
/* Our SYN-ACKs must have a >0 window */
tcph->window = (oth->syn && !oth->ack) ? htons(5) : 0;
if (oth->syn && oth->ack) {
tcph->rst = true;
tcph->ack_seq = false;
} else {
tcph->syn = oth->syn;
tcph->ack = true;
tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn);
}
#if 0
/* Rate-limit replies to !SYN,ACKs */
if (!oth->syn && oth->ack)
if (!xrlim_allow(rt_dst(ort), HZ))
return;
#endif
} else if (mode == XTTARPIT_HONEYPOT) { } else if (mode == XTTARPIT_HONEYPOT) {
/* Do not answer any resets regardless of combination */ /* Do not answer any resets regardless of combination */
if (oth->rst || oth->seq == 0xDEADBEEF) if (oth->rst || oth->seq == 0xDEADBEEF)