Re: idea to block some scanners

2014-06-30 Thread Leclerc, Sebastien
> De : mxb [mailto:m...@alumni.chalmers.se], 30 juin 2014 03:26 > Could you please, post updated version to the list? Sure! --- /dev/null Mon Jun 30 07:57:57 2014 +++ tarpitd.c Fri Jun 27 14:01:35 2014 @@ -0,0 +1,525 @@ +/* + * Copyright (c) 2014 Sebastien Leclerc. All rights reserved. + * Co

Re: idea to block some scanners

2014-06-30 Thread mxb
Could you please, post updated version to the list? //mxb On 27 jun 2014, at 20:09, Leclerc, Sebastien wrote: >> Stuart Henderson , 2014-06-27 11:00 >> >>> +/* Stolen from ftp-proxy */ >> >> Old version of ftp-proxy I guess. It hasn't used DIOCNATLOOK for several >> releases, it has switch

Re: idea to block some scanners

2014-06-27 Thread Leclerc, Sebastien
> Stuart Henderson , 2014-06-27 11:00 > > > +/* Stolen from ftp-proxy */ > > Old version of ftp-proxy I guess. It hasn't used DIOCNATLOOK for several > releases, it has switched to the much easier-to-use divert-to / getsockname(). And also : > Henning Brauer , 2014-06-27 14:07 > noo

Re: idea to block some scanners

2014-06-27 Thread Henning Brauer
* Leclerc, Sebastien [2014-06-27 16:40]: > + if (ioctl(pfdev, DIOCNATLOOK, &pnl) == -1) no DIOCNATLOOK is stupid. I'll celebrate the day when I can kill it. Please look at less ancient ftp-proxy/*-proxy code for inspiration.

Re: idea to block some scanners

2014-06-27 Thread Leclerc, Sebastien
> DeĀ : Stuart Henderson [mailto:st...@openbsd.org] > > On 2014/06/27 09:58, Leclerc, Sebastien wrote: > > Hi, > > > > Would this piece of code be useful to someone else than me? > > Not sure about base, but it may make sense to add to ports. I'm not familiar with the creation of a port, but I'm

Re: idea to block some scanners

2014-06-27 Thread Stuart Henderson
On 2014/06/27 09:58, Leclerc, Sebastien wrote: > Hi, > > Would this piece of code be useful to someone else than me? Not sure about base, but it may make sense to add to ports. > +/* Stolen from ftp-proxy */ Old version of ftp-proxy I guess. It hasn't used DIOCNATLOOK for several releases, it h

idea to block some scanners

2014-06-27 Thread Leclerc, Sebastien
Hi, Would this piece of code be useful to someone else than me? It works with pf's divert-to to block some scanners. It's basically a stripped-down spamd(8), that listens to every TCP connection that is diverted to it, and sends the received data to the great bitbucket in the sky, one byte per se