mirror of
git://git.code.sf.net/p/xtables-addons/xtables-addons
synced 2025-09-07 13:15:12 +02:00
Merge branch 'master' into ACCOUNT
This commit is contained in:
Jan Engelhardt
6
.gitignore
vendored
6
.gitignore
vendored
@@ -10,6 +10,12 @@ GNUmakefile
|
||||
|
||||
/downloads
|
||||
|
||||
/Makefile.iptrules
|
||||
/Makefile.mans
|
||||
/.*.lst
|
||||
/matches.man
|
||||
/targets.man
|
||||
|
||||
/aclocal.m4
|
||||
/autom4te*.cache
|
||||
/compile
|
||||
|
||||
14
INSTALL
14
INSTALL
@@ -46,6 +46,9 @@ Configuring and compiling
|
||||
/lib/modules/$(running version)/build, which usually points to
|
||||
the right directory. (If not, you need to install something.)
|
||||
|
||||
For RPM building, it should be /usr/src/linux-obj/...
|
||||
or whatever location the distro makes use of.
|
||||
|
||||
--with-xtables=
|
||||
|
||||
Specifies the path to the directory where we may find
|
||||
@@ -55,11 +58,11 @@ Configuring and compiling
|
||||
include/xtables.h. (The latter to support both standard
|
||||
/usr/include and the iptables source root.)
|
||||
|
||||
--with-libxtdir=
|
||||
--with-xtlibdir=
|
||||
|
||||
Specifies the path to where the newly built extensions should
|
||||
be installed when `make install` is run. It uses the same
|
||||
default as the Xtables package, ${libexecdir}/xtables.
|
||||
default as the Xtables/iptables package, ${libexecdir}/xtables.
|
||||
|
||||
If you want to enable debugging, use
|
||||
|
||||
@@ -72,15 +75,10 @@ much easier.)
|
||||
Build-time options
|
||||
==================
|
||||
|
||||
V= controls the kernel's make verbosity.
|
||||
V= controls the verbosity of make commands.
|
||||
V=0 "silent" (output filename)
|
||||
V=1 "verbose" (entire gcc command line)
|
||||
|
||||
VU= controls the Xt-a make verbosity.
|
||||
VU=0 output filename
|
||||
VU=1 output filename and source file
|
||||
VU=2 entire gcc command line
|
||||
|
||||
|
||||
Note to distribution packagers
|
||||
==============================
|
||||
|
||||
12
Makefile.am
12
Makefile.am
@@ -5,16 +5,16 @@ SUBDIRS = extensions
|
||||
|
||||
man_MANS := xtables-addons.8
|
||||
|
||||
xtables-addons.8: ${srcdir}/xtables-addons.8.in extensions/matches.man extensions/targets.man
|
||||
${am__verbose_GEN}sed -e '/@MATCHES@/ r extensions/matches.man' -e '/@TARGET@/ r extensions/targets.man' $< >$@;
|
||||
.PHONY: FORCE
|
||||
FORCE:
|
||||
|
||||
extensions/%:
|
||||
${MAKE} ${AM_MAKEFLAGS} -C $(@D) $(@F)
|
||||
xtables-addons.8: FORCE
|
||||
${MAKE} -f Makefile.mans all;
|
||||
|
||||
install-exec-local:
|
||||
install-exec-hook:
|
||||
depmod -a || :;
|
||||
|
||||
config.status: extensions/GNUmakefile.in
|
||||
config.status: Makefile.iptrules.in
|
||||
|
||||
.PHONY: tarball
|
||||
tarball:
|
||||
|
||||
29
Makefile.extra
Normal file
29
Makefile.extra
Normal file
@@ -0,0 +1,29 @@
|
||||
# -*- Makefile -*-
|
||||
# AUTOMAKE
|
||||
|
||||
XA_SRCDIR = ${srcdir}
|
||||
XA_TOPSRCDIR = ${top_srcdir}
|
||||
XA_ABSTOPSRCDIR = ${abs_top_srcdir}
|
||||
export XA_SRCDIR
|
||||
export XA_TOPSRCDIR
|
||||
export XA_ABSTOPSRCDIR
|
||||
|
||||
_mcall = ${MAKE} -f ${top_builddir}/Makefile.iptrules
|
||||
|
||||
all-local: user-all-local
|
||||
|
||||
install-exec-local: user-install-local
|
||||
|
||||
clean-local: user-clean-local
|
||||
|
||||
user-all-local:
|
||||
${_mcall} all;
|
||||
|
||||
# Have no user-install-data-local ATM
|
||||
user-install-local: user-install-exec-local
|
||||
|
||||
user-install-exec-local:
|
||||
${_mcall} install;
|
||||
|
||||
user-clean-local:
|
||||
${_mcall} clean;
|
||||
59
Makefile.iptrules.in
Normal file
59
Makefile.iptrules.in
Normal file
@@ -0,0 +1,59 @@
|
||||
# -*- Makefile -*-
|
||||
# MANUAL
|
||||
|
||||
prefix = @prefix@
|
||||
exec_prefix = @exec_prefix@
|
||||
libexecdir = @libexecdir@
|
||||
xtlibdir = @xtlibdir@
|
||||
|
||||
CC = @CC@
|
||||
CCLD = ${CC}
|
||||
|
||||
regular_CFLAGS = @regular_CFLAGS@
|
||||
xtables_CFLAGS = @xtables_CFLAGS@
|
||||
AM_CFLAGS = ${regular_CFLAGS} ${xtables_CFLAGS}
|
||||
AM_DEPFLAGS = -Wp,-MMD,$(@D)/.$(@F).d,-MT,$@
|
||||
|
||||
AM_DEFAULT_VERBOSITY = 0
|
||||
am__v_CC_0 = @echo " CC " $@;
|
||||
am__v_CCLD_0 = @echo " CCLD " $@;
|
||||
am__v_GEN_0 = @echo " GEN " $@;
|
||||
am__v_SILENT_0 = @
|
||||
am__v_CC_ = ${am__v_CC_${AM_DEFAULT_VERBOSITY}}
|
||||
am__v_CCLD_ = ${am__v_CCLD_${AM_DEFAULT_VERBOSITY}}
|
||||
am__v_GEN_ = ${am__v_GEN_${AM_DEFAULT_VERBOSITY}}
|
||||
am__v_SILENT_ = ${am__v_SILENT_${AM_DEFAULT_VERBOSITY}}
|
||||
AM_V_CC = ${am__v_CC_${V}}
|
||||
AM_V_CCLD = ${am__v_CCLD_${V}}
|
||||
AM_V_GEN = ${am__v_GEN_${V}}
|
||||
AM_V_silent = ${am__v_GEN_${V}}
|
||||
|
||||
include ${XA_TOPSRCDIR}/mconfig
|
||||
-include ${XA_TOPSRCDIR}/mconfig.*
|
||||
include ${XA_SRCDIR}/Mbuild
|
||||
-include ${XA_SRCDIR}/Mbuild.*
|
||||
|
||||
targets := $(filter-out %/,${obj-m})
|
||||
subdirs_list := $(filter %/,${obj-m})
|
||||
|
||||
.SECONDARY:
|
||||
|
||||
.PHONY: all install clean
|
||||
|
||||
all: ${targets}
|
||||
@for i in ${subdirs_list}; do ${MAKE} -C $$i; done;
|
||||
|
||||
install: ${targets}
|
||||
@for i in ${subdirs_list}; do ${MAKE} -C $$i $@; done;
|
||||
install -dm0755 "${DESTDIR}/${xtlibdir}";
|
||||
install -pm0755 $^ "${DESTDIR}/${xtlibdir}";
|
||||
|
||||
clean:
|
||||
@for i in ${subdirs_list}; do ${MAKE} -C $$i $@; done;
|
||||
rm -f *.oo *.so;
|
||||
|
||||
lib%.so: lib%.oo
|
||||
${AM_V_CCLD}${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $<;
|
||||
|
||||
%.oo: ${XA_SRCDIR}/%.c
|
||||
${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
|
||||
40
Makefile.mans.in
Normal file
40
Makefile.mans.in
Normal file
@@ -0,0 +1,40 @@
|
||||
# -*- Makefile -*-
|
||||
# MANUAL
|
||||
|
||||
srcdir := @srcdir@
|
||||
|
||||
wcman_matches := $(shell find "${srcdir}" -name 'libxt_[a-z]*.man')
|
||||
wcman_targets := $(shell find "${srcdir}" -name 'libxt_[A-Z]*.man')
|
||||
wlist_matches := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_matches})
|
||||
wlist_targets := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_targets})
|
||||
|
||||
.PHONY: FORCE
|
||||
|
||||
FORCE:
|
||||
|
||||
.manpages.lst: FORCE
|
||||
@echo "${wlist_targets} ${wlist_matches}" >$@.tmp; \
|
||||
cmp -s $@ $@.tmp || mv $@.tmp $@; \
|
||||
rm -f $@.tmp;
|
||||
|
||||
man_run = \
|
||||
${AM_V_GEN}for ext in $(1); do \
|
||||
name="$${ext%.man}"; \
|
||||
name="$${name\#\#*/libxt_}"; \
|
||||
if [ -f "$$ext" ]; then \
|
||||
echo ".SS $$name"; \
|
||||
cat "$$ext"; \
|
||||
continue; \
|
||||
fi; \
|
||||
done >$@;
|
||||
|
||||
all: xtables-addons.8
|
||||
|
||||
xtables-addons.8: ${srcdir}/xtables-addons.8.in matches.man targets.man
|
||||
${AM_V_GEN}sed -e '/@MATCHES@/ r matches.man' -e '/@TARGET@/ r targets.man' $< >$@;
|
||||
|
||||
matches.man: .manpages.lst ${wcman_matches}
|
||||
$(call man_run,${wlist_matches})
|
||||
|
||||
targets.man: .manpages.lst ${wcman_targets}
|
||||
$(call man_run,${wlist_targets})
|
||||
12
configure.ac
12
configure.ac
@@ -1,5 +1,5 @@
|
||||
|
||||
AC_INIT([xtables-addons], [1.17])
|
||||
AC_INIT([xtables-addons], [1.18])
|
||||
AC_CONFIG_HEADERS([config.h])
|
||||
AC_CONFIG_MACRO_DIR([m4])
|
||||
AC_PROG_INSTALL
|
||||
@@ -79,17 +79,16 @@ krel="${krel#*.}";
|
||||
kminor="${krel%%.*}";
|
||||
krel="${krel#*.}";
|
||||
kmicro="${krel%%.*}";
|
||||
krel2="${krel#*.}";
|
||||
if test "$krel" = "$krel2"; then
|
||||
if test "$kmicro" = "$krel"; then
|
||||
kstable=0;
|
||||
else
|
||||
kstable="${krel%%.*}";
|
||||
kstable="${krel#*.}";
|
||||
if test -z "$kstable"; then
|
||||
kstable=0;
|
||||
fi;
|
||||
fi;
|
||||
echo "Found kernel version $kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
|
||||
if test "$kmajor" -gt 2 -o "$kminor" -gt 6 -o "$kmicro" -gt 30; then
|
||||
if test "$kmajor" -gt 2 -o "$kminor" -gt 6 -o "$kmicro" -gt 31; then
|
||||
echo "WARNING: You are trying a newer kernel. Results may vary. :-)";
|
||||
elif test \( "$kmajor" -lt 2 -o "$kminor" -lt 6 -o "$kmicro" -lt 17 \) -o \
|
||||
\( "$kmajor" -eq 2 -a "$kminor" -eq 6 -a "$kmicro" -eq 18 -a \
|
||||
@@ -104,5 +103,6 @@ AC_SUBST([kinclude_CFLAGS])
|
||||
AC_SUBST([kbuilddir])
|
||||
AC_SUBST([ksourcedir])
|
||||
AC_SUBST([xtlibdir])
|
||||
AC_CONFIG_FILES([Makefile extensions/GNUmakefile extensions/ipset/GNUmakefile])
|
||||
AC_CONFIG_FILES([Makefile Makefile.iptrules Makefile.mans
|
||||
extensions/Makefile extensions/ipset/Makefile])
|
||||
AC_OUTPUT
|
||||
|
||||
4
doc/README.psd
Normal file
4
doc/README.psd
Normal file
@@ -0,0 +1,4 @@
|
||||
PSD (Portscan Detection) External extensions for Xtables-addons
|
||||
|
||||
Example:
|
||||
iptables -A INPUT -m psd --psd-weight-threshold 21 --psd-delay-threshold 300 --psd-lo-ports-weight 1 --psd-hi-ports-weight 10 -j LOG --log-prefix "PSD: "
|
||||
@@ -1,10 +1,18 @@
|
||||
|
||||
|
||||
- build: support for Linux 2.6.31-rc1
|
||||
- build: compile fixes for 2.6.31-rt
|
||||
|
||||
|
||||
Xtables-addons 1.18 (September 09 2009)
|
||||
=======================================
|
||||
- build: support for Linux 2.6.31
|
||||
- ipset: fast forward to v3.2
|
||||
- quota2: support anonymous counters
|
||||
- quota2: reduce memory footprint for anonymous counters
|
||||
- quota2: extend locked period during cleanup (locking bugfix)
|
||||
- quota2: use strtoull instead of strtoul
|
||||
- merged xt_ACCOUNT module
|
||||
- merged xt_psd module
|
||||
|
||||
|
||||
Xtables-addons 1.17 (June 16 2009)
|
||||
|
||||
@@ -1,141 +0,0 @@
|
||||
# -*- Makefile -*-
|
||||
|
||||
top_srcdir := @top_srcdir@
|
||||
srcdir := @srcdir@
|
||||
abstop_srcdir := $(shell readlink -f ${top_srcdir})
|
||||
abssrcdir := $(shell readlink -f ${srcdir})
|
||||
|
||||
ifeq (${abstop_srcdir},)
|
||||
$(error Path resolution of ${top_srcdir} failed)
|
||||
endif
|
||||
ifeq (${abssrcdir},)
|
||||
$(error Path resolution of ${srcdir} failed)
|
||||
endif
|
||||
|
||||
prefix := @prefix@
|
||||
exec_prefix := @exec_prefix@
|
||||
libdir := @libdir@
|
||||
libexecdir := @libexecdir@
|
||||
xtlibdir := @xtlibdir@
|
||||
kbuilddir := @kbuilddir@
|
||||
|
||||
CC := @CC@
|
||||
CCLD := ${CC}
|
||||
CFLAGS := @CFLAGS@
|
||||
LDFLAGS := @LDFLAGS@
|
||||
regular_CFLAGS := @regular_CFLAGS@
|
||||
kinclude_CFLAGS := @kinclude_CFLAGS@
|
||||
xtables_CFLAGS := @xtables_CFLAGS@
|
||||
|
||||
AM_CFLAGS := ${regular_CFLAGS} -I${top_srcdir}/include ${xtables_CFLAGS} ${kinclude_CFLAGS}
|
||||
AM_DEPFLAGS = -Wp,-MMD,$(@D)/.$(@F).d,-MT,$@
|
||||
|
||||
VU := 0
|
||||
am__v_CC_0 = @echo " CC " $@;
|
||||
am__v_CCLD_0 = @echo " CCLD " $@;
|
||||
am__v_GEN_0 = @echo " GEN " $@;
|
||||
am__v_SILENT_0 = @
|
||||
AM_V_CC = ${am__v_CC_${VU}}
|
||||
AM_V_CCLD = ${am__v_CCLD_${VU}}
|
||||
AM_V_GEN = ${am__v_GEN_${VU}}
|
||||
AM_V_silent = ${am__v_GEN_${VU}}
|
||||
|
||||
|
||||
#
|
||||
# Wildcard module list
|
||||
#
|
||||
include ${top_srcdir}/mconfig
|
||||
-include ${top_srcdir}/mconfig.*
|
||||
include ${srcdir}/Mbuild
|
||||
-include ${srcdir}/Mbuild.*
|
||||
-include ${srcdir}/*.Mbuild
|
||||
|
||||
|
||||
#
|
||||
# Building blocks
|
||||
#
|
||||
targets := $(filter-out %/,${obj-m})
|
||||
targets_install := ${targets}
|
||||
subdirs_list := $(filter %/,${obj-m})
|
||||
|
||||
.SECONDARY:
|
||||
|
||||
.PHONY: all install clean distclean FORCE
|
||||
|
||||
all: subdirs modules user matches.man targets.man
|
||||
|
||||
subdirs:
|
||||
@for i in ${subdirs_list}; do ${MAKE} -C $$i; done;
|
||||
|
||||
subdirs-install:
|
||||
@for i in ${subdirs_list}; do ${MAKE} -C $$i install; done;
|
||||
|
||||
user: ${targets}
|
||||
|
||||
install: modules_install subdirs-install ${targets_install}
|
||||
@mkdir -p "${DESTDIR}${xtlibdir}";
|
||||
install -pm0755 ${targets_install} "${DESTDIR}${xtlibdir}/";
|
||||
|
||||
clean: clean_modules
|
||||
@for i in ${subdirs_list}; do ${MAKE} -C $$i clean; done;
|
||||
rm -f *.oo *.so;
|
||||
|
||||
distclean: clean
|
||||
rm -f .*.d .manpages.lst;
|
||||
|
||||
-include .*.d
|
||||
|
||||
|
||||
#
|
||||
# Call out to kbuild
|
||||
#
|
||||
.PHONY: modules modules_install clean_modules
|
||||
|
||||
modules:
|
||||
${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${MAKE} -C ${kbuilddir} M=${abssrcdir} XA_TOPSRCDIR=${abstop_srcdir} modules; fi;
|
||||
|
||||
modules_install:
|
||||
${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${MAKE} -C ${kbuilddir} M=${abssrcdir} XA_TOPSRCDIR=${abstop_srcdir} INSTALL_MOD_PATH=${DESTDIR} modules_install; fi;
|
||||
|
||||
clean_modules:
|
||||
${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${MAKE} -C ${kbuilddir} M=${abssrcdir} XA_TOPSRCDIR=${abstop_srcdir} clean; fi;
|
||||
|
||||
|
||||
#
|
||||
# Shared libraries
|
||||
#
|
||||
lib%.so: lib%.oo
|
||||
${AM_V_CCLD}${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $<;
|
||||
|
||||
lib%.oo: ${srcdir}/lib%.c
|
||||
${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=lib$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
|
||||
|
||||
|
||||
#
|
||||
# Manpages
|
||||
#
|
||||
wcman_matches := $(wildcard ${srcdir}/libxt_[a-z]*.man)
|
||||
wcman_targets := $(wildcard ${srcdir}/libxt_[A-Z]*.man)
|
||||
wlist_matches := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_matches})
|
||||
wlist_targets := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_targets})
|
||||
|
||||
.manpages.lst: FORCE
|
||||
@echo "${wlist_targets} ${wlist_matches}" >$@.tmp; \
|
||||
cmp -s $@ $@.tmp || mv $@.tmp $@; \
|
||||
rm -f $@.tmp;
|
||||
|
||||
man_run = \
|
||||
${AM_V_GEN}for ext in $(1); do \
|
||||
f="${srcdir}/libxt_$$ext.man"; \
|
||||
if [ -f "$$f" ]; then \
|
||||
echo ".SS $$ext"; \
|
||||
cat "$$f"; \
|
||||
continue; \
|
||||
fi; \
|
||||
done >$@;
|
||||
|
||||
matches.man: .manpages.lst ${wcman_matches}
|
||||
$(call man_run,${wlist_matches})
|
||||
|
||||
targets.man: .manpages.lst ${wcman_targets}
|
||||
$(call man_run,${wlist_targets})
|
||||
@@ -1,7 +1,7 @@
|
||||
# -*- Makefile -*-
|
||||
|
||||
include ${XA_TOPSRCDIR}/mconfig
|
||||
-include ${XA_TOPSRCDIR}/mconfig.*
|
||||
include ${XA_ABSTOPSRCDIR}/mconfig
|
||||
-include ${XA_ABSTOPSRCDIR}/mconfig.*
|
||||
|
||||
obj-m += compat_xtables.o
|
||||
|
||||
@@ -26,6 +26,7 @@ obj-${build_ipset} += ipset/
|
||||
obj-${build_ipv4options} += xt_ipv4options.o
|
||||
obj-${build_length2} += xt_length2.o
|
||||
obj-${build_lscan} += xt_lscan.o
|
||||
obj-${build_psd} += xt_psd.o
|
||||
obj-${build_quota2} += xt_quota2.o
|
||||
|
||||
-include ${M}/*.Kbuild
|
||||
|
||||
24
extensions/Makefile.am
Normal file
24
extensions/Makefile.am
Normal file
@@ -0,0 +1,24 @@
|
||||
# -*- Makefile -*-
|
||||
# AUTOMAKE
|
||||
|
||||
# Not having Kbuild in Makefile.extra because it will already recurse
|
||||
.PHONY: modules modules_install clean_modules
|
||||
|
||||
_kcall = ${MAKE} -C ${kbuilddir} M=${abs_srcdir}
|
||||
|
||||
modules:
|
||||
${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${_kcall} modules; fi;
|
||||
|
||||
modules_install:
|
||||
${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${_kcall} INSTALL_MOD_PATH=${DESTDIR} modules_install; fi;
|
||||
|
||||
clean_modules:
|
||||
${AM_V_silent}if [ -n "${kbuilddir}" ]; then ${_kcall} clean; fi;
|
||||
|
||||
all-local: modules
|
||||
|
||||
install-exec-local: modules_install
|
||||
|
||||
clean-local: clean_modules
|
||||
|
||||
include ../Makefile.extra
|
||||
@@ -1,3 +1,5 @@
|
||||
# -*- Makefile -*-
|
||||
|
||||
obj-${build_ACCOUNT} += libxt_ACCOUNT.so
|
||||
obj-${build_CHAOS} += libxt_CHAOS.so
|
||||
obj-${build_DELUDE} += libxt_DELUDE.so
|
||||
@@ -19,4 +21,5 @@ obj-${build_ipset} += ipset/
|
||||
obj-${build_ipv4options} += libxt_ipv4options.so
|
||||
obj-${build_length2} += libxt_length2.so
|
||||
obj-${build_lscan} += libxt_lscan.so
|
||||
obj-${build_psd} += libxt_psd.so
|
||||
obj-${build_quota2} += libxt_quota2.so
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
# -*- Makefile -*-
|
||||
|
||||
top_srcdir := @top_srcdir@
|
||||
srcdir := @srcdir@
|
||||
datarootdir := @datarootdir@
|
||||
abstop_srcdir := $(shell readlink -f ${top_srcdir})
|
||||
abssrcdir := $(shell readlink -f ${srcdir})
|
||||
|
||||
ifeq (${abstop_srcdir},)
|
||||
$(error Path resolution of ${top_srcdir} failed)
|
||||
endif
|
||||
ifeq (${abssrcdir},)
|
||||
$(error Path resolution of ${srcdir} failed)
|
||||
endif
|
||||
|
||||
prefix := @prefix@
|
||||
exec_prefix := @exec_prefix@
|
||||
sbindir := @sbindir@
|
||||
libdir := @libdir@
|
||||
libexecdir := @libexecdir@
|
||||
xtlibdir := @xtlibdir@
|
||||
kbuilddir := @kbuilddir@
|
||||
man8dir := @mandir@/man8
|
||||
|
||||
CC := @CC@
|
||||
CCLD := ${CC}
|
||||
CFLAGS := @CFLAGS@
|
||||
LDFLAGS := @LDFLAGS@
|
||||
regular_CFLAGS := @regular_CFLAGS@
|
||||
kinclude_CFLAGS := @kinclude_CFLAGS@
|
||||
xtables_CFLAGS := @xtables_CFLAGS@
|
||||
|
||||
AM_CFLAGS := ${regular_CFLAGS} -I${top_srcdir}/include ${xtables_CFLAGS} ${kinclude_CFLAGS} -DIPSET_LIB_DIR=\"${xtlibdir}\"
|
||||
AM_DEPFLAGS = -Wp,-MMD,$(@D)/.$(@F).d,-MT,$@
|
||||
|
||||
VU := 0
|
||||
am__1verbose_CC_0 = @echo " CC " $@;
|
||||
am__1verbose_CCLD_0 = @echo " CCLD " $@;
|
||||
am__1verbose_CC_1 = @echo " CC " $@ "<-" $<;
|
||||
am__1verbose_CCLD_1 = @echo " CCLD " $@ "<-" $^;
|
||||
am__verbose_CC = ${am__1verbose_CC_${VU}}
|
||||
am__verbose_CCLD = ${am__1verbose_CCLD_${VU}}
|
||||
|
||||
#
|
||||
# Building blocks
|
||||
#
|
||||
targets := $(addsuffix .so,$(addprefix libipset_, \
|
||||
iphash ipmap ipporthash ipportiphash ipportnethash iptree \
|
||||
iptreemap macipmap nethash portmap setlist))
|
||||
|
||||
.SECONDARY:
|
||||
|
||||
.PHONY: all install clean distclean FORCE
|
||||
|
||||
all: ipset ${targets}
|
||||
|
||||
install: all
|
||||
@mkdir -p "${DESTDIR}${sbindir}" "${DESTDIR}${xtlibdir}" "${DESTDIR}${man8dir}";
|
||||
install -pm0755 ipset "${DESTDIR}${sbindir}/";
|
||||
install -pm0755 ${targets} "${DESTDIR}${xtlibdir}/";
|
||||
install -pm0644 ipset.8 "${DESTDIR}${man8dir}/";
|
||||
|
||||
clean:
|
||||
rm -f *.oo *.so *.o ipset;
|
||||
|
||||
distclean: clean
|
||||
rm -f .*.d;
|
||||
|
||||
-include .*.d
|
||||
|
||||
|
||||
ipset: ipset.o
|
||||
${am__verbose_CCLD}${CCLD} ${AM_LDFLAGS} ${LDFLAGS} -o $@ $< -ldl -rdynamic;
|
||||
|
||||
#
|
||||
# Shared libraries
|
||||
#
|
||||
lib%.so: lib%.oo
|
||||
${am__verbose_CCLD}${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $<;
|
||||
|
||||
libipset_%.oo: ${srcdir}/ipset_%.c
|
||||
${am__verbose_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
|
||||
|
||||
%.o: %.c
|
||||
${am__verbose_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} ${CFLAGS} -o $@ -c $<;
|
||||
9
extensions/ipset/Makefile.am
Normal file
9
extensions/ipset/Makefile.am
Normal file
@@ -0,0 +1,9 @@
|
||||
# -*- Makefile -*-
|
||||
|
||||
AM_CFLAGS = ${regular_CFLAGS} -DIPSET_LIB_DIR=\"${xtlibdir}\"
|
||||
|
||||
include ../../Makefile.extra
|
||||
|
||||
sbin_PROGRAMS = ipset
|
||||
ipset_LDADD = -ldl
|
||||
ipset_LDFLAGS = -rdynamic
|
||||
7
extensions/ipset/Mbuild
Normal file
7
extensions/ipset/Mbuild
Normal file
@@ -0,0 +1,7 @@
|
||||
# -*- Makefile -*-
|
||||
|
||||
obj-m += $(addprefix lib,$(patsubst %.c,%.so,$(notdir \
|
||||
$(wildcard ${XA_SRCDIR}/ipset_*.c))))
|
||||
|
||||
libipset_%.oo: ${XA_SRCDIR}/ipset_%.c
|
||||
${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
|
||||
@@ -39,7 +39,7 @@
|
||||
static struct list_head set_type_list; /* all registered sets */
|
||||
static struct ip_set **ip_set_list; /* all individual sets */
|
||||
static DEFINE_RWLOCK(ip_set_lock); /* protects the lists and the hash */
|
||||
static DECLARE_MUTEX(ip_set_app_mutex); /* serializes user access */
|
||||
static struct semaphore ip_set_app_mutex; /* serializes user access */
|
||||
static ip_set_id_t ip_set_max = CONFIG_IP_NF_SET_MAX;
|
||||
static ip_set_id_t ip_set_bindings_hash_size = CONFIG_IP_NF_SET_HASHSIZE;
|
||||
static struct list_head *ip_set_hash; /* hash of bindings */
|
||||
@@ -1373,7 +1373,7 @@ static int ip_set_restore(void *data,
|
||||
while (members_size + set->type->reqsize <=
|
||||
set_restore->members_size) {
|
||||
line++;
|
||||
DP("members: %d, line %d", members_size, line);
|
||||
DP("members: %d, line %d", members_size, line);
|
||||
res = __ip_set_addip(index,
|
||||
data + used + members_size,
|
||||
set->type->reqsize);
|
||||
@@ -1911,13 +1911,23 @@ ip_set_sockfn_get(struct sock *sk, int optval, void *user, int *len)
|
||||
res = -ENOENT;
|
||||
goto done;
|
||||
}
|
||||
|
||||
#define SETLIST(set) (strcmp(set->type->typename, "setlist") == 0)
|
||||
|
||||
used = 0;
|
||||
if (index == IP_SET_INVALID_ID) {
|
||||
/* Save all sets */
|
||||
/* Save all sets: ugly setlist type dependency */
|
||||
int setlist = 0;
|
||||
setlists:
|
||||
for (i = 0; i < ip_set_max && res == 0; i++) {
|
||||
if (ip_set_list[i] != NULL)
|
||||
if (ip_set_list[i] != NULL
|
||||
&& !(setlist ^ SETLIST(ip_set_list[i])))
|
||||
res = ip_set_save_set(i, data, &used, *len);
|
||||
}
|
||||
if (!setlist) {
|
||||
setlist = 1;
|
||||
goto setlists;
|
||||
}
|
||||
} else {
|
||||
/* Save an individual set */
|
||||
res = ip_set_save_set(index, data, &used, *len);
|
||||
@@ -2006,6 +2016,7 @@ static int __init ip_set_init(void)
|
||||
int res;
|
||||
ip_set_id_t i;
|
||||
|
||||
sema_init(&ip_set_app_mutex, 1);
|
||||
get_random_bytes(&ip_set_hash_random, 4);
|
||||
if (max_sets)
|
||||
ip_set_max = max_sets;
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
#include <linux/module.h>
|
||||
#include <linux/moduleparam.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/jiffies.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/slab.h>
|
||||
#include <linux/delay.h>
|
||||
|
||||
@@ -14,6 +14,7 @@
|
||||
#include <linux/kernel.h>
|
||||
#include <linux/module.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/jiffies.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/slab.h>
|
||||
#include <linux/delay.h>
|
||||
@@ -338,7 +339,7 @@ KADT(iptreemap, add, ipaddr, ip)
|
||||
|
||||
static inline int
|
||||
__delip_single(struct ip_set *set, ip_set_ip_t *hash_ip,
|
||||
ip_set_ip_t ip, unsigned int __nocast flags)
|
||||
ip_set_ip_t ip, gfp_t flags)
|
||||
{
|
||||
struct ip_set_iptreemap *map = set->data;
|
||||
struct ip_set_iptreemap_b *btree;
|
||||
@@ -364,7 +365,7 @@ __delip_single(struct ip_set *set, ip_set_ip_t *hash_ip,
|
||||
|
||||
static inline int
|
||||
iptreemap_del(struct ip_set *set, ip_set_ip_t *hash_ip,
|
||||
ip_set_ip_t start, ip_set_ip_t end, unsigned int __nocast flags)
|
||||
ip_set_ip_t start, ip_set_ip_t end, gfp_t flags)
|
||||
{
|
||||
struct ip_set_iptreemap *map = set->data;
|
||||
struct ip_set_iptreemap_b *btree;
|
||||
|
||||
@@ -40,7 +40,7 @@ struct harray {
|
||||
};
|
||||
|
||||
static inline void *
|
||||
__harray_malloc(size_t hashsize, size_t typesize, int flags)
|
||||
__harray_malloc(size_t hashsize, size_t typesize, gfp_t flags)
|
||||
{
|
||||
struct harray *harray;
|
||||
size_t max_elements, size, i, j;
|
||||
@@ -88,7 +88,7 @@ __harray_malloc(size_t hashsize, size_t typesize, int flags)
|
||||
}
|
||||
|
||||
static inline void *
|
||||
harray_malloc(size_t hashsize, size_t typesize, int flags)
|
||||
harray_malloc(size_t hashsize, size_t typesize, gfp_t flags)
|
||||
{
|
||||
void *harray;
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
* after ==> ref, index
|
||||
*/
|
||||
|
||||
static inline bool
|
||||
static inline int
|
||||
next_index_eq(const struct ip_set_setlist *map, int i, ip_set_id_t index)
|
||||
{
|
||||
return i < map->size && map->index[i] == index;
|
||||
@@ -38,17 +38,15 @@ setlist_utest(struct ip_set *set, const void *data, u_int32_t size,
|
||||
struct ip_set *s;
|
||||
|
||||
if (req->before && req->ref[0] == '\0')
|
||||
return -EINVAL;
|
||||
return 0;
|
||||
|
||||
index = __ip_set_get_byname(req->name, &s);
|
||||
if (index == IP_SET_INVALID_ID)
|
||||
return -EEXIST;
|
||||
return 0;
|
||||
if (req->ref[0] != '\0') {
|
||||
ref = __ip_set_get_byname(req->ref, &s);
|
||||
if (ref == IP_SET_INVALID_ID) {
|
||||
res = -EEXIST;
|
||||
if (ref == IP_SET_INVALID_ID)
|
||||
goto finish;
|
||||
}
|
||||
}
|
||||
for (i = 0; i < map->size
|
||||
&& map->index[i] != IP_SET_INVALID_ID; i++) {
|
||||
@@ -172,7 +170,7 @@ setlist_kadd(struct ip_set *set,
|
||||
return res;
|
||||
}
|
||||
|
||||
static inline bool
|
||||
static inline int
|
||||
unshift_setlist(struct ip_set_setlist *map, int i)
|
||||
{
|
||||
int j;
|
||||
|
||||
@@ -50,6 +50,9 @@ IP set bindings pointing to sets and iptables matches and targets
|
||||
referring to sets creates references, which protects the given sets in
|
||||
the kernel. A set cannot be removed (destroyed) while there is a single
|
||||
reference pointing to it.
|
||||
.P
|
||||
.B
|
||||
Please note, binding sets is a deprecated feature and will be removed in a later release. Switch to the multidata type of sets from using bindings.
|
||||
.SH OPTIONS
|
||||
The options that are recognized by
|
||||
.B ipset
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe"
|
||||
#endif
|
||||
|
||||
#define IPSET_VERSION "2.5.0"
|
||||
#define IPSET_VERSION "3.2"
|
||||
|
||||
char program_name[] = "ipset";
|
||||
char program_version[] = IPSET_VERSION;
|
||||
|
||||
158
extensions/libxt_psd.c
Normal file
158
extensions/libxt_psd.c
Normal file
@@ -0,0 +1,158 @@
|
||||
/*
|
||||
Shared library add-on to iptables to add PSD support
|
||||
|
||||
Copyright (C) 2000,2001 astaro AG
|
||||
|
||||
This file is distributed under the terms of the GNU General Public
|
||||
License (GPL). Copies of the GPL can be obtained from:
|
||||
ftp://prep.ai.mit.edu/pub/gnu/GPL
|
||||
|
||||
2000-05-04 Markus Hennig <hennig@astaro.de> : initial
|
||||
2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
|
||||
2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
|
||||
2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
|
||||
2003-03-02 Harald Welte <laforge@netfilter.org>: fix 'storage' bug
|
||||
2008-04-03 Mohd Nawawi <nawawi@tracenetworkcorporation.com>: update to 2.6.24 / 1.4 code
|
||||
2008-06-24 Mohd Nawawi <nawawi@tracenetworkcorporation.com>: update to 2.6.24 / 1.4.1 code
|
||||
2009-08-07 Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com> : ported to xtables-addons
|
||||
*/
|
||||
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <netdb.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <syslog.h>
|
||||
#include <getopt.h>
|
||||
#include <xtables.h>
|
||||
#include <linux/netfilter/x_tables.h>
|
||||
#include "xt_psd.h"
|
||||
|
||||
/* Function which prints out usage message. */
|
||||
static void psd_mt_help(void) {
|
||||
printf(
|
||||
"psd match options:\n"
|
||||
" --psd-weight-threshold threshhold Portscan detection weight threshold\n"
|
||||
" --psd-delay-threshold delay Portscan detection delay threshold\n"
|
||||
" --psd-lo-ports-weight lo Privileged ports weight\n"
|
||||
" --psd-hi-ports-weight hi High ports weight\n\n");
|
||||
}
|
||||
|
||||
static const struct option psd_mt_opts[] = {
|
||||
{.name = "psd-weight-threshold", .has_arg = true, .val = '1'},
|
||||
{.name = "psd-delay-threshold", .has_arg = true, .val = '2'},
|
||||
{.name = "psd-lo-ports-weight", .has_arg = true, .val = '3'},
|
||||
{.name = "psd-hi-ports-weight", .has_arg = true, .val = '4'},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
/* Initialize the target. */
|
||||
static void psd_mt_init(struct xt_entry_match *match) {
|
||||
struct xt_psd_info *psdinfo = (struct xt_psd_info *)match->data;
|
||||
psdinfo->weight_threshold = SCAN_WEIGHT_THRESHOLD;
|
||||
psdinfo->delay_threshold = SCAN_DELAY_THRESHOLD;
|
||||
psdinfo->lo_ports_weight = PORT_WEIGHT_PRIV;
|
||||
psdinfo->hi_ports_weight = PORT_WEIGHT_HIGH;
|
||||
}
|
||||
|
||||
#define XT_PSD_OPT_CTRESH 0x01
|
||||
#define XT_PSD_OPT_DTRESH 0x02
|
||||
#define XT_PSD_OPT_LPWEIGHT 0x04
|
||||
#define XT_PSD_OPT_HPWEIGHT 0x08
|
||||
|
||||
static int psd_mt_parse(int c, char **argv, int invert, unsigned int *flags,
|
||||
const void *entry, struct xt_entry_match **match)
|
||||
{
|
||||
struct xt_psd_info *psdinfo = (struct xt_psd_info *)(*match)->data;
|
||||
unsigned int num;
|
||||
|
||||
switch (c) {
|
||||
/* PSD-weight-threshold */
|
||||
case '1':
|
||||
if (*flags & XT_PSD_OPT_CTRESH)
|
||||
xtables_error(PARAMETER_PROBLEM,"Can't specify --psd-weight-threshold twice");
|
||||
if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE))
|
||||
xtables_error(PARAMETER_PROBLEM, "bad --psd-weight-threshold '%s'", optarg);
|
||||
psdinfo->weight_threshold = num;
|
||||
*flags |= XT_PSD_OPT_CTRESH;
|
||||
return true;
|
||||
|
||||
/* PSD-delay-threshold */
|
||||
case '2':
|
||||
if (*flags & XT_PSD_OPT_DTRESH)
|
||||
xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-delay-threshold twice");
|
||||
if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE))
|
||||
xtables_error(PARAMETER_PROBLEM, "bad --psd-delay-threshold '%s'", optarg);
|
||||
psdinfo->delay_threshold = num;
|
||||
*flags |= XT_PSD_OPT_DTRESH;
|
||||
return true;
|
||||
|
||||
/* PSD-lo-ports-weight */
|
||||
case '3':
|
||||
if (*flags & XT_PSD_OPT_LPWEIGHT)
|
||||
xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-lo-ports-weight twice");
|
||||
if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE))
|
||||
xtables_error(PARAMETER_PROBLEM, "bad --psd-lo-ports-weight '%s'", optarg);
|
||||
psdinfo->lo_ports_weight = num;
|
||||
*flags |= XT_PSD_OPT_LPWEIGHT;
|
||||
return true;
|
||||
|
||||
/* PSD-hi-ports-weight */
|
||||
case '4':
|
||||
if (*flags & XT_PSD_OPT_HPWEIGHT)
|
||||
xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-hi-ports-weight twice");
|
||||
if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE))
|
||||
xtables_error(PARAMETER_PROBLEM, "bad --psd-hi-ports-weight '%s'", optarg);
|
||||
psdinfo->hi_ports_weight = num;
|
||||
*flags |= XT_PSD_OPT_HPWEIGHT;
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/* Final check; nothing. */
|
||||
static void psd_mt_final_check(unsigned int flags) {}
|
||||
|
||||
/* Prints out the targinfo. */
|
||||
static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
|
||||
{
|
||||
const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data;
|
||||
printf("psd ");
|
||||
printf("weight-threshold: %u ", psdinfo->weight_threshold);
|
||||
printf("delay-threshold: %u ", psdinfo->delay_threshold);
|
||||
printf("lo-ports-weight: %u ", psdinfo->lo_ports_weight);
|
||||
printf("hi-ports-weight: %u ", psdinfo->hi_ports_weight);
|
||||
}
|
||||
|
||||
/* Saves the union ipt_targinfo in parsable form to stdout. */
|
||||
static void psd_mt_save(const void *ip, const struct xt_entry_match *match)
|
||||
{
|
||||
const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data;
|
||||
printf("--psd-weight-threshold %u ", psdinfo->weight_threshold);
|
||||
printf("--psd-delay-threshold %u ", psdinfo->delay_threshold);
|
||||
printf("--psd-lo-ports-weight %u ", psdinfo->lo_ports_weight);
|
||||
printf("--psd-hi-ports-weight %u ", psdinfo->hi_ports_weight);
|
||||
}
|
||||
|
||||
static struct xtables_match psd_mt_reg = {
|
||||
.name = "psd",
|
||||
.version = XTABLES_VERSION,
|
||||
.revision = 1,
|
||||
.family = PF_INET,
|
||||
.size = XT_ALIGN(sizeof(struct xt_psd_info)),
|
||||
.userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)),
|
||||
.help = psd_mt_help,
|
||||
.init = psd_mt_init,
|
||||
.parse = psd_mt_parse,
|
||||
.final_check = psd_mt_final_check,
|
||||
.print = psd_mt_print,
|
||||
.save = psd_mt_save,
|
||||
.extra_opts = psd_mt_opts,
|
||||
};
|
||||
|
||||
static __attribute__((constructor)) void psd_mt_ldr(void)
|
||||
{
|
||||
xtables_register_match(&psd_mt_reg);
|
||||
}
|
||||
|
||||
18
extensions/libxt_psd.man
Normal file
18
extensions/libxt_psd.man
Normal file
@@ -0,0 +1,18 @@
|
||||
Attempt to detect TCP and UDP port scans. This match was derived from
|
||||
Solar Designer's scanlogd.
|
||||
.TP
|
||||
.BI "--psd-weight-threshold " "threshold"
|
||||
Total weight of the latest TCP/UDP packets with different
|
||||
destination ports coming from the same host to be treated as port
|
||||
scan sequence.
|
||||
.TP
|
||||
.BI "--psd-delay-threshold " "delay"
|
||||
Delay (in hundredths of second) for the packets with different
|
||||
destination ports coming from the same host to be treated as
|
||||
possible port scan subsequence.
|
||||
.TP
|
||||
.BI "--psd-lo-ports-weight " "weight"
|
||||
Weight of the packet with privileged (<=1024) destination port.
|
||||
.TP
|
||||
.BI "--psd-hi-ports-weight " "weight"
|
||||
Weight of the packet with non-priviliged destination port.
|
||||
@@ -55,7 +55,7 @@ struct condition_variable {
|
||||
|
||||
/* proc_lock is a user context only semaphore used for write access */
|
||||
/* to the conditions' list. */
|
||||
static DECLARE_MUTEX(proc_lock);
|
||||
static struct semaphore proc_lock;
|
||||
|
||||
static LIST_HEAD(conditions_list);
|
||||
static struct proc_dir_entry *proc_net_condition;
|
||||
@@ -232,6 +232,7 @@ static int __init condition_mt_init(void)
|
||||
{
|
||||
int ret;
|
||||
|
||||
sema_init(&proc_lock, 1);
|
||||
proc_net_condition = proc_mkdir(dir_name, init_net__proc_net);
|
||||
if (proc_net_condition == NULL)
|
||||
return -EACCES;
|
||||
|
||||
6
extensions/xt_psd.Kconfig
Normal file
6
extensions/xt_psd.Kconfig
Normal file
@@ -0,0 +1,6 @@
|
||||
config NETFILTER_XT_MATCH_PSD
|
||||
tristate 'psd match support'
|
||||
depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
|
||||
---help---
|
||||
This option adds a `psd' match, which allows you to create rules in
|
||||
any iptables table wich will detect TCP and UDP port scans.
|
||||
332
extensions/xt_psd.c
Normal file
332
extensions/xt_psd.c
Normal file
@@ -0,0 +1,332 @@
|
||||
/*
|
||||
This is a module which is used for PSD (portscan detection)
|
||||
Derived from scanlogd v2.1 written by Solar Designer <solar@false.com>
|
||||
and LOG target module.
|
||||
|
||||
Copyright (C) 2000,2001 astaro AG
|
||||
|
||||
This file is distributed under the terms of the GNU General Public
|
||||
License (GPL). Copies of the GPL can be obtained from:
|
||||
ftp://prep.ai.mit.edu/pub/gnu/GPL
|
||||
|
||||
2000-05-04 Markus Hennig <hennig@astaro.de> : initial
|
||||
2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
|
||||
2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
|
||||
2001-01-02 Dennis Koslowski <koslowski@astaro.de> : output modified
|
||||
2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
|
||||
2004-05-05 Martijn Lievaart <m@rtij.nl> : ported to 2.6
|
||||
2007-04-05 Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com> : ported to 2.6.18
|
||||
2008-03-21 Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com> : ported to 2.6.24
|
||||
2009-08-07 Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com> : ported to xtables-addons
|
||||
*/
|
||||
|
||||
#define pr_fmt(x) KBUILD_MODNAME ": " x
|
||||
#include <linux/module.h>
|
||||
#include <linux/moduleparam.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/ip.h>
|
||||
#include <net/tcp.h>
|
||||
#include <linux/spinlock.h>
|
||||
#include <linux/netfilter_ipv4/ip_tables.h>
|
||||
#include <linux/netfilter/x_tables.h>
|
||||
#include "xt_psd.h"
|
||||
#include "compat_xtables.h"
|
||||
|
||||
MODULE_LICENSE("GPL");
|
||||
MODULE_AUTHOR("Dennis Koslowski <koslowski@astaro.com>");
|
||||
MODULE_AUTHOR("Martijn Lievaart <m@rtij.nl>");
|
||||
MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
|
||||
MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com>");
|
||||
MODULE_DESCRIPTION("Xtables: PSD - portscan detection");
|
||||
MODULE_ALIAS("ipt_psd");
|
||||
|
||||
#define HF_DADDR_CHANGING 0x01
|
||||
#define HF_SPORT_CHANGING 0x02
|
||||
#define HF_TOS_CHANGING 0x04
|
||||
#define HF_TTL_CHANGING 0x08
|
||||
|
||||
/*
|
||||
* Information we keep per each target port
|
||||
*/
|
||||
struct port {
|
||||
u_int16_t number; /* port number */
|
||||
u_int8_t proto; /* protocol number */
|
||||
u_int8_t and_flags; /* tcp ANDed flags */
|
||||
u_int8_t or_flags; /* tcp ORed flags */
|
||||
};
|
||||
|
||||
/*
|
||||
* Information we keep per each source address.
|
||||
*/
|
||||
struct host {
|
||||
struct host *next; /* Next entry with the same hash */
|
||||
unsigned long timestamp; /* Last update time */
|
||||
struct in_addr src_addr; /* Source address */
|
||||
struct in_addr dest_addr; /* Destination address */
|
||||
unsigned short src_port; /* Source port */
|
||||
int count; /* Number of ports in the list */
|
||||
int weight; /* Total weight of ports in the list */
|
||||
struct port ports[SCAN_MAX_COUNT - 1]; /* List of ports */
|
||||
unsigned char tos; /* TOS */
|
||||
unsigned char ttl; /* TTL */
|
||||
unsigned char flags; /* HF_ flags bitmask */
|
||||
};
|
||||
|
||||
/*
|
||||
* State information.
|
||||
*/
|
||||
static struct {
|
||||
spinlock_t lock;
|
||||
struct host list[LIST_SIZE]; /* List of source addresses */
|
||||
struct host *hash[HASH_SIZE]; /* Hash: pointers into the list */
|
||||
int index; /* Oldest entry to be replaced */
|
||||
} state;
|
||||
|
||||
/*
|
||||
* Convert an IP address into a hash table index.
|
||||
*/
|
||||
static inline int hashfunc(struct in_addr addr)
|
||||
{
|
||||
unsigned int value;
|
||||
int hash;
|
||||
|
||||
value = addr.s_addr;
|
||||
hash = 0;
|
||||
do {
|
||||
hash ^= value;
|
||||
} while ((value >>= HASH_LOG) != 0);
|
||||
|
||||
return hash & (HASH_SIZE - 1);
|
||||
}
|
||||
|
||||
static bool
|
||||
xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match)
|
||||
{
|
||||
struct iphdr *iph;
|
||||
struct tcphdr *tcph;
|
||||
struct in_addr addr;
|
||||
u_int16_t src_port,dest_port;
|
||||
u_int8_t tcp_flags, proto;
|
||||
unsigned long now;
|
||||
struct host *curr, *last, **head;
|
||||
int hash, index, count;
|
||||
/* Parameters from userspace */
|
||||
const struct xt_psd_info *psdinfo = match->matchinfo;
|
||||
|
||||
/* IP header */
|
||||
iph = ip_hdr(pskb);
|
||||
|
||||
/* Sanity check */
|
||||
if (ntohs(iph->frag_off) & IP_OFFSET) {
|
||||
pr_debug("sanity check failed\n");
|
||||
return false;
|
||||
}
|
||||
|
||||
/* TCP or UDP ? */
|
||||
proto = iph->protocol;
|
||||
|
||||
if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) {
|
||||
pr_debug("protocol not supported\n");
|
||||
return false;
|
||||
}
|
||||
|
||||
/* Get the source address, source & destination ports, and TCP flags */
|
||||
|
||||
addr.s_addr = iph->saddr;
|
||||
|
||||
tcph = (void *)iph + ip_hdrlen(pskb);
|
||||
|
||||
/* Yep, it's dirty */
|
||||
src_port = tcph->source;
|
||||
dest_port = tcph->dest;
|
||||
|
||||
if (proto == IPPROTO_TCP)
|
||||
tcp_flags = *((u_int8_t*)tcph + 13);
|
||||
else
|
||||
tcp_flags = 0x00;
|
||||
|
||||
/* We're using IP address 0.0.0.0 for a special purpose here, so don't let
|
||||
* them spoof us. [DHCP needs this feature - HW] */
|
||||
if (addr.s_addr == 0) {
|
||||
pr_debug("spoofed source address (0.0.0.0)\n");
|
||||
return false;
|
||||
}
|
||||
|
||||
/* Use jiffies here not to depend on someone setting the time while we're
|
||||
* running; we need to be careful with possible return value overflows. */
|
||||
now = jiffies;
|
||||
|
||||
spin_lock(&state.lock);
|
||||
|
||||
/* Do we know this source address already? */
|
||||
count = 0;
|
||||
last = NULL;
|
||||
if ((curr = *(head = &state.hash[hash = hashfunc(addr)])) != NULL)
|
||||
do {
|
||||
if (curr->src_addr.s_addr == addr.s_addr)
|
||||
break;
|
||||
count++;
|
||||
if (curr->next != NULL)
|
||||
last = curr;
|
||||
} while ((curr = curr->next) != NULL);
|
||||
|
||||
if (curr != NULL) {
|
||||
|
||||
/* We know this address, and the entry isn't too old. Update it. */
|
||||
if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
|
||||
time_after_eq(now, curr->timestamp)) {
|
||||
|
||||
/* Just update the appropriate list entry if we've seen this port already */
|
||||
for (index = 0; index < curr->count; index++) {
|
||||
if (curr->ports[index].number == dest_port) {
|
||||
curr->ports[index].proto = proto;
|
||||
curr->ports[index].and_flags &= tcp_flags;
|
||||
curr->ports[index].or_flags |= tcp_flags;
|
||||
goto out_no_match;
|
||||
}
|
||||
}
|
||||
|
||||
/* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */
|
||||
if (proto == IPPROTO_TCP && (tcph->ack || tcph->rst))
|
||||
goto out_no_match;
|
||||
|
||||
/* Packet to a new port, and not TCP/ACK: update the timestamp */
|
||||
curr->timestamp = now;
|
||||
|
||||
/* Logged this scan already? Then drop the packet. */
|
||||
if (curr->weight >= psdinfo->weight_threshold)
|
||||
goto out_match;
|
||||
|
||||
/* Specify if destination address, source port, TOS or TTL are not fixed */
|
||||
if (curr->dest_addr.s_addr != iph->daddr)
|
||||
curr->flags |= HF_DADDR_CHANGING;
|
||||
if (curr->src_port != src_port)
|
||||
curr->flags |= HF_SPORT_CHANGING;
|
||||
if (curr->tos != iph->tos)
|
||||
curr->flags |= HF_TOS_CHANGING;
|
||||
if (curr->ttl != iph->ttl)
|
||||
curr->flags |= HF_TTL_CHANGING;
|
||||
|
||||
/* Update the total weight */
|
||||
curr->weight += (ntohs(dest_port) < 1024) ?
|
||||
psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
|
||||
|
||||
/* Got enough destination ports to decide that this is a scan? */
|
||||
/* Then log it and drop the packet. */
|
||||
if (curr->weight >= psdinfo->weight_threshold)
|
||||
goto out_match;
|
||||
|
||||
/* Remember the new port */
|
||||
if (curr->count < SCAN_MAX_COUNT) {
|
||||
curr->ports[curr->count].number = dest_port;
|
||||
curr->ports[curr->count].proto = proto;
|
||||
curr->ports[curr->count].and_flags = tcp_flags;
|
||||
curr->ports[curr->count].or_flags = tcp_flags;
|
||||
curr->count++;
|
||||
}
|
||||
|
||||
goto out_no_match;
|
||||
}
|
||||
|
||||
/* We know this address, but the entry is outdated. Mark it unused, and
|
||||
* remove from the hash table. We'll allocate a new entry instead since
|
||||
* this one might get re-used too soon. */
|
||||
curr->src_addr.s_addr = 0;
|
||||
if (last != NULL)
|
||||
last->next = last->next->next;
|
||||
else if (*head != NULL)
|
||||
*head = (*head)->next;
|
||||
last = NULL;
|
||||
}
|
||||
|
||||
/* We don't need an ACK from a new source address */
|
||||
if (proto == IPPROTO_TCP && tcph->ack)
|
||||
goto out_no_match;
|
||||
|
||||
/* Got too many source addresses with the same hash value? Then remove the
|
||||
* oldest one from the hash table, so that they can't take too much of our
|
||||
* CPU time even with carefully chosen spoofed IP addresses. */
|
||||
if (count >= HASH_MAX && last != NULL)
|
||||
last->next = NULL;
|
||||
|
||||
/* We're going to re-use the oldest list entry, so remove it from the hash
|
||||
* table first (if it is really already in use, and isn't removed from the
|
||||
* hash table already because of the HASH_MAX check above). */
|
||||
|
||||
/* First, find it */
|
||||
if (state.list[state.index].src_addr.s_addr != 0)
|
||||
head = &state.hash[hashfunc(state.list[state.index].src_addr)];
|
||||
else
|
||||
head = &last;
|
||||
last = NULL;
|
||||
if ((curr = *head) != NULL)
|
||||
do {
|
||||
if (curr == &state.list[state.index])
|
||||
break;
|
||||
last = curr;
|
||||
} while ((curr = curr->next) != NULL);
|
||||
|
||||
/* Then, remove it */
|
||||
if (curr != NULL) {
|
||||
if (last != NULL)
|
||||
last->next = last->next->next;
|
||||
else if (*head != NULL)
|
||||
*head = (*head)->next;
|
||||
}
|
||||
|
||||
/* Get our list entry */
|
||||
curr = &state.list[state.index++];
|
||||
if (state.index >= LIST_SIZE)
|
||||
state.index = 0;
|
||||
|
||||
/* Link it into the hash table */
|
||||
head = &state.hash[hash];
|
||||
curr->next = *head;
|
||||
*head = curr;
|
||||
|
||||
/* And fill in the fields */
|
||||
curr->timestamp = now;
|
||||
curr->src_addr = addr;
|
||||
curr->dest_addr.s_addr = iph->daddr;
|
||||
curr->src_port = src_port;
|
||||
curr->count = 1;
|
||||
curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
|
||||
curr->ports[0].number = dest_port;
|
||||
curr->ports[0].proto = proto;
|
||||
curr->ports[0].and_flags = tcp_flags;
|
||||
curr->ports[0].or_flags = tcp_flags;
|
||||
curr->tos = iph->tos;
|
||||
curr->ttl = iph->ttl;
|
||||
|
||||
out_no_match:
|
||||
spin_unlock(&state.lock);
|
||||
return false;
|
||||
|
||||
out_match:
|
||||
spin_unlock(&state.lock);
|
||||
return true;
|
||||
}
|
||||
|
||||
static struct xt_match xt_psd_reg __read_mostly = {
|
||||
.name = "psd",
|
||||
.family = AF_INET,
|
||||
.revision = 1,
|
||||
.match = xt_psd_match,
|
||||
.matchsize = sizeof(struct xt_psd_info),
|
||||
.me = THIS_MODULE,
|
||||
};
|
||||
|
||||
static int __init xt_psd_init(void)
|
||||
{
|
||||
spin_lock_init(&(state.lock));
|
||||
return xt_register_match(&xt_psd_reg);
|
||||
}
|
||||
|
||||
static void __exit xt_psd_exit(void)
|
||||
{
|
||||
xt_unregister_match(&xt_psd_reg);
|
||||
}
|
||||
|
||||
module_init(xt_psd_init);
|
||||
module_exit(xt_psd_exit);
|
||||
|
||||
41
extensions/xt_psd.h
Normal file
41
extensions/xt_psd.h
Normal file
@@ -0,0 +1,41 @@
|
||||
#ifndef _LINUX_NETFILTER_XT_PSD_H
|
||||
#define _LINUX_NETFILTER_XT_PSD_H 1
|
||||
|
||||
#include <linux/param.h>
|
||||
#include <linux/types.h>
|
||||
|
||||
/*
|
||||
* High port numbers have a lower weight to reduce the frequency of false
|
||||
* positives, such as from passive mode FTP transfers.
|
||||
*/
|
||||
#define PORT_WEIGHT_PRIV 3
|
||||
#define PORT_WEIGHT_HIGH 1
|
||||
#define PSD_MAX_RATE 10000
|
||||
|
||||
/*
|
||||
* Port scan detection thresholds: at least COUNT ports need to be scanned
|
||||
* from the same source, with no longer than DELAY ticks between ports.
|
||||
*/
|
||||
#define SCAN_MIN_COUNT 7
|
||||
#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
|
||||
#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
|
||||
#define SCAN_DELAY_THRESHOLD (300) /* old usage of HZ here was erroneously and broke under uml */
|
||||
|
||||
/*
|
||||
* Keep track of up to LIST_SIZE source addresses, using a hash table of
|
||||
* HASH_SIZE entries for faster lookups, but limiting hash collisions to
|
||||
* HASH_MAX source addresses per the same hash value.
|
||||
*/
|
||||
#define LIST_SIZE 0x100
|
||||
#define HASH_LOG 9
|
||||
#define HASH_SIZE (1 << HASH_LOG)
|
||||
#define HASH_MAX 0x10
|
||||
|
||||
struct xt_psd_info {
|
||||
__u32 weight_threshold;
|
||||
__u32 delay_threshold;
|
||||
__u16 lo_ports_weight;
|
||||
__u16 hi_ports_weight;
|
||||
};
|
||||
|
||||
#endif /*_LINUX_NETFILTER_XT_PSD_H*/
|
||||
1
mconfig
1
mconfig
@@ -21,4 +21,5 @@ build_ipset=m
|
||||
build_ipv4options=m
|
||||
build_length2=m
|
||||
build_lscan=m
|
||||
build_psd=m
|
||||
build_quota2=m
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
.TH xtables\-addons 8 "v1.17 (2009\-06\-16)" "" "v1.17 (2009\-06\-16)"
|
||||
.TH xtables-addons 8 "v1.18 (2009-09-09)" "" "v1.18 (2009-09-09)"
|
||||
.SH Name
|
||||
Xtables\-addons - additional extensions for iptables, ip6tables, etc.
|
||||
Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
|
||||
.SH Targets
|
||||
.\" @TARGET@
|
||||
.SH Matches
|
||||
|
||||
Reference in New Issue
Block a user