xtables-addons accepted in Debian
Xtables-addons is a is a project developped by Jan Engelhardt to replace the old patch-o-matic repository for the Linux kernel and iptables. Instead of patching the kernel source, extensions are built as modules and thus allow extending kernels without recompilation.
I have created a Debian package, split in two parts: xtables-addons-source (the sources of the kernel modules), and xtables-addons-common (common files: shared libraries, man pages, binaries).
To install xtables-addons on Debian (sid only, but the package works on Lenny after a rebuild), run the following commands:
apt-get install module-assistant xtables-addons-source module-assistant prepare module-assistant auto-install xtables-addons-source
It will automatically install the headers for your kernel, build the modules, create a local package, and install it. What’s interesting is that, unlike before (using p-o-m or kernel patches), there is no need to reboot.
It adds new targets for iptables:
- CHAOS: randomly use REJECT, DELUDE or TARPIT targets. This will fool network scanners by returning random results
- DELUDE: always reply to a SYN by a SYN-ACK. This will fool TCP half-open discovery
- DHCPADDR: replace a MAC address from and to a VMware host
- IPMARK: mark a packet, based on its IP address
- LOGMARK: log packet and mark to syslog
- SYSRQ: trigger a sysreq over the network (sending a saK over the network looks like a real funny idea ;)
- TARPIT: try to slow down (or DoS) remote host by capturing the session and holding it for a long time, using a 0-bytes TCP window. Run that on port 25 if you have no mail server to slow down spammers ;)
There’s also a list of new matches modules for iptables:
- condition: match on boolean value stored in /proc/net/nf_condition/name
- dhcpaddr: match the DHCP Client Host address in a DHCP message
- fuzzy: match a rate limit based on a fuzzy logic controller
- geoip: match a packet by its source or destination country
- ipp2p: match (certain) p2p protocols
- portscan: try to match port scanners based on packet contents
- quota2: named counters
It also provides a version of ipset, a framework to manager sets of IP addresses in iptables rules efficiently.