netfilter buglog - Nov 2016 - [Bug 1097] New: TARPIT function does not work in ip6tables

https://bugzilla.netfilter.org/show_bug.cgi?id=1097

            Bug ID: 1097
           Summary: TARPIT function does not work in ip6tables
           Product: netfilter/iptables
           Version: unspecified
          Hardware: x86_64
                OS: Ubuntu
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ip6_tables (kernel)
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: rich.compton at charter.com

I have ip6tables configured very similarly to iptables.  The configuration is
set up to tarpit all tcp connections.  The configuration works well with IPv4
but fails with IPv6.  I see packets incrementing in the TAR chain but no
tarpitting packets are transmitted on IPv6.


sudo ip6tables -L -n -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 ACCEPT     all      lo     *       ::1                  ::1         
    5   488 DROP       all      ens33  *       ::/0                 ::/0        
    5   424 ACCEPT     icmpv6    ens32  *       ::/0                 ::/0       
    0     0 TAR        all      ens32  *       ::/0                 ::/0        

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
    4   320 TAR        all      ens32  *       ::/0                 ::/0        

Chain OUTPUT (policy ACCEPT 3 packets, 200 bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain TAR (2 references)
 pkts bytes target     prot opt in     out     source               destination 
    4   320 LOG        tcp      *      *       ::/0                 ::/0       
         limit: avg 10/min burst 5 LOG flags 0 level 4 prefix "Tarpitting:
"
    4   320 TARPIT     tcp      *      *       ::/0                 ::/0       
         limit: avg 100/sec burst 5 -j TARPIT --tarpit 
    0     0 LOG        all      *      *       ::/0                 ::/0       
         limit: avg 10/min burst 5 LOG flags 0 level 4 prefix "Dropping:
"
    0     0 DROP       all      *      *       ::/0                 ::/0  


sudo tcpdump -i ens32 -n -vv ip or ip6
11:08:00.960362 IP6 (hlim 62, next-header TCP (6) payload length: 40)
2001:db8:2::2.57444 > 2001:db66:22::2.23: Flags [S], cksum 0xff54 (correct),
seq 855240622, win 28800, options [mss 1440,sackOK,TS val 2398100706 ecr
0,nop,wscale 7], length 0
11:08:01.966189 IP6 (hlim 62, next-header TCP (6) payload length: 40)
2001:db8:2::2.57444 > 2001:db66:22::2.23: Flags [S], cksum 0xfe5a (correct),
seq 855240622, win 28800, options [mss 1440,sackOK,TS val 2398100956 ecr
0,nop,wscale 7], length 0
11:08:03.964066 IP6 (hlim 62, next-header TCP (6) payload length: 40)
2001:db8:2::2.57444 > 2001:db66:22::2.23: Flags [S], cksum 0xfc65 (correct),
seq 855240622, win 28800, options [mss 1440,sackOK,TS val 2398101457 ecr
0,nop,wscale 7], length 0
11:08:07.983900 IP6 (hlim 62, next-header TCP (6) payload length: 40)
2001:db8:2::2.57444 > 2001:db66:22::2.23: Flags [S], cksum 0xf87a (correct),
seq 855240622, win 28800, options [mss 1440,sackOK,TS val 2398102460 ecr
0,nop,wscale 7], length 0
11:08:15.999846 IP6 (hlim 62, next-header TCP (6) payload length: 40)
2001:db8:2::2.57444 > 2001:db66:22::2.23: Flags [S], cksum 0xf0a6 (correct),
seq 855240622, win 28800, options [mss 1440,sackOK,TS val 2398104464 ecr
0,nop,wscale 7], length 0

rcompton at tarpit-honeypot:~$ uname -a
Linux tarpit-honeypot 4.4.0-45-generic #66-Ubuntu SMP Wed Oct 19 14:12:37 UTC
2016 x86_64 x86_64 x86_64 GNU/Linux

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20161109/b3473c23/attachment.html>