Apa definisi dari addrtype di iptables?

Saya ingin menggunakan addrtypedalam kombinasi dengan -srcsebagai aturan di salah satu rantai filter saya seperti untuk menjatuhkan beberapa bogon ips:

-A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j WEB

Halaman manual mengatakan sebagai berikut

addrtype
Modul ini cocok dengan paket-paket berdasarkan pada jenis alamatnya. Jenis alamat digunakan dalam tumpukan jaringan kernel dan mengkategorikan alamat ke dalam berbagai grup. Definisi yang tepat dari grup itu tergantung pada protokol layer tiga spesifik.

Jenis alamat berikut dimungkinkan:

• UNSPEC alamat yang tidak ditentukan (mis. 0.0.0.0)
• UNICAST alamat unicast
• LOKAL alamat lokal
• BROADCAST alamat siaran
• ANYCAST paket anycast
• MULTICAST alamat multicast
• BLACKHOLE alamat blackhole
• Alamat yang tidak terjangkau
• LARUTKAN alamat yang dilarang
• BUAT FIXME
• NAT FIXME
• XRESOLVE

Tidak jelas apa definisi yang tepat dan mengatakan itu tergantung pada protokol layer 3 spesifik. Inilah yang saya pikirkan:

• UNICAST (! BROADCAST,! MULTICAST,! ANYCAST)
• LOKAL ( 127.0.0.0/8)
• BROADCAST ( *.*.*.255)
• ANYCAST ( *.*.*.*)
• MULTICAST ( 224.0.0.0/4)

Adakah yang memiliki gagasan yang jelas tentang apa artinya itu dan bagaimana penerapannya oleh iptables (misalnya, bagaimana ia tahu di mana letak BLACKHOLE)?

Saya pikir itu tergantung pada Anda untuk membuat kernel tahu yang merupakan tipe alamat blackhole.

Dari file xt_addrtype.h dalam kode sumber iptables, Anda dapat melihat:

/* rtn_type enum values from rtnetlink.h, but shifted */                        
enum {                                                                          
    XT_ADDRTYPE_UNSPEC = 1 << 0,                                                
    XT_ADDRTYPE_UNICAST = 1 << 1,   /* 1 << RTN_UNICAST */                      
    XT_ADDRTYPE_LOCAL  = 1 << 2,    /* 1 << RTN_LOCAL, etc */                   
    XT_ADDRTYPE_BROADCAST = 1 << 3,                                             
    XT_ADDRTYPE_ANYCAST = 1 << 4,                                               
    XT_ADDRTYPE_MULTICAST = 1 << 5,                                             
    XT_ADDRTYPE_BLACKHOLE = 1 << 6,                                             
    XT_ADDRTYPE_UNREACHABLE = 1 << 7,                                           
    XT_ADDRTYPE_PROHIBIT = 1 << 8,                                              
    XT_ADDRTYPE_THROW = 1 << 9,                                                 
    XT_ADDRTYPE_NAT = 1 << 10,                                                  
    XT_ADDRTYPE_XRESOLVE = 1 << 11,                                             
};

Dan di rtnetlink.h, Anda akan melihat definisi yang sama:

enum {                                                                          
    RTN_UNSPEC,                                                                 
    RTN_UNICAST,        /* Gateway or direct route  */                          
    RTN_LOCAL,      /* Accept locally       */                                  
    RTN_BROADCAST,      /* Accept locally as broadcast,                         
                   send as broadcast */                                         
    RTN_ANYCAST,        /* Accept locally as broadcast,                         
                   but send as unicast */                                       
    RTN_MULTICAST,      /* Multicast route      */                              
    RTN_BLACKHOLE,      /* Drop             */                                  
    RTN_UNREACHABLE,    /* Destination is unreachable   */                      
    RTN_PROHIBIT,       /* Administratively prohibited  */                      
    RTN_THROW,      /* Not in this table        */                              
    RTN_NAT,        /* Translate this address   */                              
    RTN_XRESOLVE,       /* Use external resolver    */                          
    __RTN_MAX                                                                   
};

Anda dapat melihat iptablesmenggunakan definisi tipe alamat yang sama dengan tumpukan jaringan kernel tcp.

Kemudian dari man ip:

Route types:

      unicast - the route entry describes real paths to the destinations covered by the route prefix.

      unreachable  - these destinations are unreachable.  Packets are discarded and the ICMP message host unreachable is generated.
               The local senders get an EHOSTUNREACH error.

      blackhole - these destinations are unreachable.  Packets are discarded silently.  The local senders get an EINVAL error.

      prohibit - these destinations are unreachable.  Packets are discarded and the  ICMP  message  communication  administratively
               prohibited is generated.  The local senders get an EACCES error.

      local - the destinations are assigned to this host.  The packets are looped back and delivered locally.

      broadcast - the destinations are broadcast addresses.  The packets are sent as link broadcasts.

      throw  - a special control route used together with policy rules. If such a route is selected, lookup in this table is termi‐
               nated pretending that no route was found.  Without policy routing it is equivalent to the absence of the route in the routing
               table.   The  packets  are  dropped  and the ICMP message net unreachable is generated.  The local senders get an ENETUNREACH
               error.

      nat - a special NAT route.  Destinations covered by the prefix are considered to  be  dummy  (or  external)  addresses  which
               require  translation  to  real  (or  internal)  ones  before forwarding.  The addresses to translate to are selected with the
               attribute Warning: Route NAT is no longer supported in Linux 2.6.

               via.

      anycast - not implemented the destinations are anycast addresses assigned to this host.  They are mainly equivalent to  local
               with one difference: such addresses are invalid when used as the source address of any packet.

      multicast - a special type used for multicast routing.  It is not present in normal routing tables.

Jadi ketika Anda mendefinisikan rute ke jaringan dengan ipperintah dan menandainya sebagai rute lubang hitam, kernel sekarang membuat jenis alamat lubang hitam jaringan ini:

ip route add blackhole X.X.X.X/24