Re: xt_TARPIT (was: ipt_account / iptables 1.3.8)

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> On Jul 9 2007 16:15, Patrick McHardy wrote:
> 
>>>>No, I couldn't come up with a good way to remove the xrlim abuse yet.
>>>>
> 
> 
> If you ask me, just remove the xrlim call, and replace it by
> some sort of 'last' timestamp, e.g.
> 
> time_t last;
> 
> static int target()
> {
> 	if (!otcph->syn && otcph->ack)
> 		if (!(last <= now() + 5))
> 			return; /* rate limit */
> 	last = now();
> }

The difference is that this is a global ratelimit, while xrlim_allow
is a per dst_entry ratelimit.

> As far as I can see, that xrlim call is there for at least one case:
> 
> tarpit sends ACKs with window=0, but client ignores the RFC-given delay for
> window=0 packets.


I think its more to prevent flooding your upstream, especially with
asynchronous bandwidth. Same reason you would usually rate-limit
the REJECT target on a DSL line.