Re: ipt_account / iptables 1.3.8

[Patrick McHardy <kaber@trash.net>]

Jozsef Kadlecsik wrote:
> On Wed, 27 Jun 2007, Jan Engelhardt wrote:
> 
>> Can I also submit a (hopefully cleaned) e.g. TARPIT?
> 
> 
> I'd like to see an IPv4/IPv6 compatible TARPIT module in the mainline
> kernel. But please extend the target so that it could be used from the
> raw table and let the reply packets skip conntrack. Thus we could
> benefit from TARPIT even in a full blown conntrack/nat setup as well.
> (If I recall correctly, that is not possible with the original version.)

The easiest way to do this would probably be to optionally attach
a notrack conntrack to new packets. Looking at the version in SVN,
it also needs:

- use generic checks for table and hook validation
- remove impossible skb->dst NULL ptr check
- remove impossible check for PACKET_OTHERHOST
- not abuse xrlim_allow
- resync TCP packet generation code with ipt_REJECT, especially
  properly deal with IPsec, not use ip_direct_send but dst_output
- kill ip_direct_send
- kill obsolete ifdefs

Shouldn't be much work, maybe I'll look into this after finishing
my conntrack hash patches if no one beats me to it.