https://github.com/github/synsanity
netfilter (iptables) target for high performance lockless SYN cookies for SYN flood mitigation
https://github.com/github/synsanity
Last synced: 5 months ago
JSON representation
netfilter (iptables) target for high performance lockless SYN cookies for SYN flood mitigation
- Host: GitHub
- URL: https://github.com/github/synsanity
- Owner: github
- License: gpl-2.0
- Archived: true
- Created: 2016-06-20T01:14:34.000Z (over 9 years ago)
- Default Branch: master
- Last Pushed: 2018-06-21T23:07:11.000Z (over 7 years ago)
- Last Synced: 2024-09-25T21:09:37.707Z (over 1 year ago)
- Language: C
- Homepage:
- Size: 27.3 KB
- Stars: 427
- Watchers: 293
- Forks: 56
- Open Issues: 4
-
Metadata Files:
- Readme: README.condition.md
- Contributing: CONTRIBUTING.md
- License: LICENSE.GPL
- Code of conduct: CODE_OF_CONDUCT.md
Awesome Lists containing this project
README
## condition match
The condition match resurrects the condition match module that was available in the 2.x series kernel.
This allows a match target that is controlled by a userspace entry in the proc filesystem. For example:
```
iptables -A INPUT -p tcp -m tcp --dport 80 -m condition ! --condition knockknock -j DROP
```
By default, the above rule will match since the condition is default 0, and port 80 will be blocked. This can be toggled via proc:
```
echo 1 > /proc/net/ipt_condition/knockknock
# packets to port 80 go through
echo 0 > /proc/net/ipt_condition/knockknock
# packets to port 80 are blocked again
```
## CONDITION target
In addition to the original condition match, a CONDITION target has been added that can change the same condition values based on a certain other set of xtables matches. For example, to enable the above port 80 condition only after a packet arrives on port 42:
```
iptables -A INPUT -p tcp -m tcp --dport 42 -j CONDITION --condition knockknock
```
This would look like the following:
```
echo 0 > /proc/net/ipt_condition/knockknock
# packets to port 80 are blocked
nc localhost 42
# packets to port 80 are unblocked
echo 0 > /proc/net/ipt_condition/knockknock
# packets to port 80 are blocked again
```