netdev - Re: [ANNOUNCE] new iptables module match large amount of ip addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Sep 2009 22:03:37 +0200
From:	Eric Leblond <eric@....fr>
To:	Mikulas Patocka <mikulas@...ax.karlin.mff.cuni.cz>
Cc:	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [ANNOUNCE] new iptables module match large amount of ip
 addresses

Hi,

Le jeudi 17 septembre 2009 à 21:15 +0200, Mikulas Patocka a écrit :
> Hi
> 
> Here I submit an iptables module that can match large amounts (millions) 
> of ip addresses efficiently using binary search.

What are the differences with ipset ? (http://ipset.netfilter.org/)

BR,

>  I needed it to protect my 
> home network from spam. It may be useful for other people too, so if you 
> want it, you can take it and add it to the kernel.
> 
> Get the patches for netfilter and kernel at:
> http://artax.karlin.mff.cuni.cz/~mikulas/xt_ipfile/
> (you need to copy the file include/linux/netfilter/xt_ipfile.h from kernel 
> sources to /usr/include/linux/netfilter/ to compile the userspace)
> 
> The main features:
> - fast matching of large amount of ip addresses using binary search.
> - an ability to match ranges of addresses or address/mask subnets.
> - fast loading of the addresses (on Pentium 3 850, 2 million addresses 
> load in 5.5s, if they are already sorted in the file, the load time is 
> just 1.5s).
> - memory efficient --- consumes only 8 bytes per address.
> 
> USAGE:
> 
> prepare a file with addreses, in this example /root/firewall/bad-ips. One 
> entry per line, the allowed formats are:
> 1.2.3.4
> 1.2.3.0/24
> 1.2.3.4-1.2.3.8
> 
> insert it into iptables with:
> iptables -A SPAM -m ipfile --src-file /root/firewall/bad-ips -j DROP
> 
> The module doesn't support ipv6 because I don't use it, but it's generic 
> enough that it could be extended for it. It could be also extended to 
> match ethernet MAC addresses.
> 
> Mikulas
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
-- 
Eric Leblond <eric@....fr>
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)