Re: ipt_account / iptables 1.3.8

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> Uhm, please add a reference next time; only by chance I found the thread origin
> at the netfilter@ list.
>
> No idea why TARPIT got removed. Maybe it's "unmaintained", but it did not need
> a lot of maintenance either. Though, people had to patch their kernel.
>
> There is no replacement for TARPIT - it's solid. (And xt_DELUDE does not
> replace it; it is something inbetween REJECT and TARPIT.)


Maintenance is only one aspect, but it is a problem since we can't
even compile test it without patching our kernels. A second problem
with most of these matches and targets is that they usually have a
broken non-64 bit clean ABI and if we decide to merge them someday
we need to fix that and thereby break compatibility before it was
even included in the kernel, which is ridiculous.

They should have never gotten into a release and we fixed that now.
You can still patch your kernel and iptables as you like.