anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-08 13:44:56 +02:00
Code Issues Releases Wiki Activity

Merge branch 'psd_cleanups' of git://git.breakpoint.cc/fw/xtables-addons

Browse Source
This commit is contained in:
Jan Engelhardt
2012-06-15 15:18:42 +02:00
parent 7cc774641a d66d07d01d
commit 0f302b7b2f
4 changed files with 75 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc/changelog.txt
View File

@@ -3,6 +3,8 @@ HEAD
==== ====
Fixes: Fixes:
- xt_psd: avoid crash due to curr->next corruption - xt_psd: avoid crash due to curr->next corruption
Changes:
- xt_psd: reject invalid match options
v1.42 (2012-04-05) v1.42 (2012-04-05)

26
extensions/libxt_psd.c
View File

@@ -30,6 +30,8 @@
#include "xt_psd.h" #include "xt_psd.h"
#include "compat_user.h" #include "compat_user.h"
#define SCAN_DELAY_THRESHOLD 300
/* Function which prints out usage message. */ /* Function which prints out usage message. */
static void psd_mt_help(void) { static void psd_mt_help(void) {
printf( printf(
@@ -137,19 +139,19 @@ static void psd_mt_save(const void *ip, const struct xt_entry_match *match)
} }
static struct xtables_match psd_mt_reg = { static struct xtables_match psd_mt_reg = {
.name = "psd", .name = "psd",
.version = XTABLES_VERSION, .version = XTABLES_VERSION,
.revision = 1, .revision = 1,
.family = NFPROTO_IPV4, .family = NFPROTO_IPV4,
.size = XT_ALIGN(sizeof(struct xt_psd_info)), .size = XT_ALIGN(sizeof(struct xt_psd_info)),
.userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)), .userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)),
.help = psd_mt_help, .help = psd_mt_help,
.init = psd_mt_init, .init = psd_mt_init,
.parse = psd_mt_parse, .parse = psd_mt_parse,
.final_check = psd_mt_final_check, .final_check = psd_mt_final_check,
.print = psd_mt_print, .print = psd_mt_print,
.save = psd_mt_save, .save = psd_mt_save,
.extra_opts = psd_mt_opts, .extra_opts = psd_mt_opts,
}; };
static __attribute__((constructor)) void psd_mt_ldr(void) static __attribute__((constructor)) void psd_mt_ldr(void)

119
extensions/xt_psd.c
View File

@@ -40,10 +40,15 @@ MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com>"
MODULE_DESCRIPTION("Xtables: PSD - portscan detection"); MODULE_DESCRIPTION("Xtables: PSD - portscan detection");
MODULE_ALIAS("ipt_psd"); MODULE_ALIAS("ipt_psd");
#define HF_DADDR_CHANGING 0x01 /*
#define HF_SPORT_CHANGING 0x02 * Keep track of up to LIST_SIZE source addresses, using a hash table of
#define HF_TOS_CHANGING 0x04 * HASH_SIZE entries for faster lookups, but limiting hash collisions to
#define HF_TTL_CHANGING 0x08 * HASH_MAX source addresses per the same hash value.
*/
#define LIST_SIZE 0x100
#define HASH_LOG 9
#define HASH_SIZE (1 << HASH_LOG)
#define HASH_MAX 0x10
/* /*
* Information we keep per each target port * Information we keep per each target port
@@ -51,35 +56,37 @@ MODULE_ALIAS("ipt_psd");
struct port { struct port {
u_int16_t number; /* port number */ u_int16_t number; /* port number */
u_int8_t proto; /* protocol number */ u_int8_t proto; /* protocol number */
u_int8_t and_flags; /* tcp ANDed flags */
u_int8_t or_flags; /* tcp ORed flags */
}; };
/* /**
* Information we keep per each source address. * Information we keep per each source address.
* @next: next entry with the same hash
* @timestamp: last update time
* @count: number of ports in the list
* @weight: total weight of ports in the list
*/ */
struct host { struct host {
struct host *next; /* Next entry with the same hash */ struct host *next;
unsigned long timestamp; /* Last update time */ unsigned long timestamp;
struct in_addr src_addr; /* Source address */ struct in_addr src_addr;
struct in_addr dest_addr; /* Destination address */ struct in_addr dest_addr;
unsigned short src_port; /* Source port */ __be16 src_port;
int count; /* Number of ports in the list */ uint16_t count;
int weight; /* Total weight of ports in the list */ uint8_t weight;
struct port ports[SCAN_MAX_COUNT - 1]; /* List of ports */ struct port ports[SCAN_MAX_COUNT-1];
unsigned char tos; /* TOS */
unsigned char ttl; /* TTL */
unsigned char flags; /* HF_ flags bitmask */
}; };
/* /**
* State information. * State information.
* @list: list of source addresses
* @hash: pointers into the list
* @index: oldest entry to be replaced
*/ */
static struct { static struct {
spinlock_t lock; spinlock_t lock;
struct host list[LIST_SIZE]; /* List of source addresses */ struct host list[LIST_SIZE];
struct host *hash[HASH_SIZE]; /* Hash: pointers into the list */ struct host *hash[HASH_SIZE];
int index; /* Oldest entry to be replaced */ int index;
} state; } state;
/* /*
@@ -111,26 +118,20 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
} _buf; } _buf;
struct in_addr addr; struct in_addr addr;
u_int16_t src_port,dest_port; u_int16_t src_port,dest_port;
u_int8_t tcp_flags, proto; u_int8_t proto;
unsigned long now; unsigned long now;
struct host *curr, *last, **head; struct host *curr, *last, **head;
int hash, index, count; int hash, index, count;
/* Parameters from userspace */ /* Parameters from userspace */
const struct xt_psd_info *psdinfo = match->matchinfo; const struct xt_psd_info *psdinfo = match->matchinfo;
/* IP header */
iph = ip_hdr(pskb); iph = ip_hdr(pskb);
/* Sanity check */
if (iph->frag_off & htons(IP_OFFSET)) { if (iph->frag_off & htons(IP_OFFSET)) {
pr_debug("sanity check failed\n"); pr_debug("sanity check failed\n");
return false; return false;
} }
/* TCP or UDP ? */
proto = iph->protocol; proto = iph->protocol;
/* Get the source address, source & destination ports, and TCP flags */
addr.s_addr = iph->saddr; addr.s_addr = iph->saddr;
/* We're using IP address 0.0.0.0 for a special purpose here, so don't let /* We're using IP address 0.0.0.0 for a special purpose here, so don't let
* them spoof us. [DHCP needs this feature - HW] */ * them spoof us. [DHCP needs this feature - HW] */
@@ -148,7 +149,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
/* Yep, it's dirty */ /* Yep, it's dirty */
src_port = tcph->source; src_port = tcph->source;
dest_port = tcph->dest; dest_port = tcph->dest;
tcp_flags = *((u_int8_t*)tcph + 13);
} else if (proto == IPPROTO_UDP || proto == IPPROTO_UDPLITE) { } else if (proto == IPPROTO_UDP || proto == IPPROTO_UDPLITE) {
udph = skb_header_pointer(pskb, match->thoff, udph = skb_header_pointer(pskb, match->thoff,
sizeof(_buf.udph), &_buf.udph); sizeof(_buf.udph), &_buf.udph);
@@ -156,14 +156,11 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
return false; return false;
src_port = udph->source; src_port = udph->source;
dest_port = udph->dest; dest_port = udph->dest;
tcp_flags = 0;
} else { } else {
pr_debug("protocol not supported\n"); pr_debug("protocol not supported\n");
return false; return false;
} }
/* Use jiffies here not to depend on someone setting the time while we're
* running; we need to be careful with possible return value overflows. */
now = jiffies; now = jiffies;
spin_lock(&state.lock); spin_lock(&state.lock);
@@ -181,7 +178,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
} while ((curr = curr->next) != NULL); } while ((curr = curr->next) != NULL);
if (curr != NULL) { if (curr != NULL) {
/* We know this address, and the entry isn't too old. Update it. */ /* We know this address, and the entry isn't too old. Update it. */
if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 && if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
time_after_eq(now, curr->timestamp)) { time_after_eq(now, curr->timestamp)) {
@@ -190,8 +186,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
for (index = 0; index < curr->count; index++) { for (index = 0; index < curr->count; index++) {
if (curr->ports[index].number == dest_port) { if (curr->ports[index].number == dest_port) {
curr->ports[index].proto = proto; curr->ports[index].proto = proto;
curr->ports[index].and_flags &= tcp_flags;
curr->ports[index].or_flags |= tcp_flags;
goto out_no_match; goto out_no_match;
} }
} }
@@ -203,26 +197,15 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
/* Packet to a new port, and not TCP/ACK: update the timestamp */ /* Packet to a new port, and not TCP/ACK: update the timestamp */
curr->timestamp = now; curr->timestamp = now;
/* Logged this scan already? Then drop the packet. */ /* Matched this scan already? Then Leave. */
if (curr->weight >= psdinfo->weight_threshold) if (curr->weight >= psdinfo->weight_threshold)
goto out_match; goto out_match;
/* Specify if destination address, source port, TOS or TTL are not fixed */
if (curr->dest_addr.s_addr != iph->daddr)
curr->flags |= HF_DADDR_CHANGING;
if (curr->src_port != src_port)
curr->flags |= HF_SPORT_CHANGING;
if (curr->tos != iph->tos)
curr->flags |= HF_TOS_CHANGING;
if (curr->ttl != iph->ttl)
curr->flags |= HF_TTL_CHANGING;
/* Update the total weight */ /* Update the total weight */
curr->weight += (ntohs(dest_port) < 1024) ? curr->weight += (ntohs(dest_port) < 1024) ?
psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
/* Got enough destination ports to decide that this is a scan? */ /* Got enough destination ports to decide that this is a scan? */
/* Then log it and drop the packet. */
if (curr->weight >= psdinfo->weight_threshold) if (curr->weight >= psdinfo->weight_threshold)
goto out_match; goto out_match;
@@ -230,8 +213,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
if (curr->count < ARRAY_SIZE(curr->ports)) { if (curr->count < ARRAY_SIZE(curr->ports)) {
curr->ports[curr->count].number = dest_port; curr->ports[curr->count].number = dest_port;
curr->ports[curr->count].proto = proto; curr->ports[curr->count].proto = proto;
curr->ports[curr->count].and_flags = tcp_flags;
curr->ports[curr->count].or_flags = tcp_flags;
curr->count++; curr->count++;
} }
@@ -303,10 +284,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
curr->ports[0].number = dest_port; curr->ports[0].number = dest_port;
curr->ports[0].proto = proto; curr->ports[0].proto = proto;
curr->ports[0].and_flags = tcp_flags;
curr->ports[0].or_flags = tcp_flags;
curr->tos = iph->tos;
curr->ttl = iph->ttl;
out_no_match: out_no_match:
spin_unlock(&state.lock); spin_unlock(&state.lock);
@@ -317,13 +294,35 @@ out_match:
return true; return true;
} }
static int psd_mt_check(const struct xt_mtchk_param *par)
{
const struct xt_psd_info *info = par->matchinfo;
if (info->weight_threshold == 0)
/* 0 would match on every 1st packet */
return -EINVAL;
if ((info->lo_ports_weight | info->hi_ports_weight) == 0)
/* would never match */
return -EINVAL;
if (info->delay_threshold > PSD_MAX_RATE ||
info->weight_threshold > PSD_MAX_RATE ||
info->lo_ports_weight > PSD_MAX_RATE ||
info->hi_ports_weight > PSD_MAX_RATE)
return -EINVAL;
return 0;
}
static struct xt_match xt_psd_reg __read_mostly = { static struct xt_match xt_psd_reg __read_mostly = {
.name = "psd", .name = "psd",
.family = NFPROTO_IPV4, .family = NFPROTO_IPV4,
.revision = 1, .revision = 1,
.match = xt_psd_match, .checkentry = psd_mt_check,
.matchsize = sizeof(struct xt_psd_info), .match = xt_psd_match,
.me = THIS_MODULE, .matchsize = sizeof(struct xt_psd_info),
.me = THIS_MODULE,
}; };
static int __init xt_psd_init(void) static int __init xt_psd_init(void)

11
extensions/xt_psd.h
View File

@@ -19,17 +19,6 @@
#define SCAN_MIN_COUNT 7 #define SCAN_MIN_COUNT 7
#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV) #define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT #define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
#define SCAN_DELAY_THRESHOLD (300) /* old usage of HZ here was erroneously and broke under uml */
/*
* Keep track of up to LIST_SIZE source addresses, using a hash table of
* HASH_SIZE entries for faster lookups, but limiting hash collisions to
* HASH_MAX source addresses per the same hash value.
*/
#define LIST_SIZE 0x100
#define HASH_LOG 9
#define HASH_SIZE (1 << HASH_LOG)
#define HASH_MAX 0x10
struct xt_psd_info { struct xt_psd_info {
__u32 weight_threshold; __u32 weight_threshold;