diff --git a/extensions/libxt_psd.c b/extensions/libxt_psd.c index bd03480..3f88ac4 100644 --- a/extensions/libxt_psd.c +++ b/extensions/libxt_psd.c @@ -142,7 +142,7 @@ static struct xtables_match psd_mt_reg = { .name = "psd", .version = XTABLES_VERSION, .revision = 1, - .family = NFPROTO_IPV4, + .family = NFPROTO_UNSPEC, .size = XT_ALIGN(sizeof(struct xt_psd_info)), .userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)), .help = psd_mt_help, diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c index b67b64e..08ce508 100644 --- a/extensions/xt_psd.c +++ b/extensions/xt_psd.c @@ -22,13 +22,14 @@ #define pr_fmt(x) KBUILD_MODNAME ": " x #include -#include #include -#include -#include +#include +#include #include -#include #include +#include +#include +#include #include "xt_psd.h" #include "compat_xtables.h" @@ -39,6 +40,7 @@ MODULE_AUTHOR("Jan Rekorajski "); MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili "); MODULE_DESCRIPTION("Xtables: PSD - portscan detection"); MODULE_ALIAS("ipt_psd"); +MODULE_ALIAS("ip6t_psd"); /* * Keep track of up to LIST_SIZE source addresses, using a hash table of @@ -50,6 +52,10 @@ MODULE_ALIAS("ipt_psd"); #define HASH_SIZE (1 << HASH_LOG) #define HASH_MAX 0x10 +#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE) +# define WITH_IPV6 1 +#endif + /* * Information we keep per each target port */ @@ -68,8 +74,6 @@ struct port { struct host { struct host *next; unsigned long timestamp; - struct in_addr src_addr; - struct in_addr dest_addr; __be16 src_port; uint16_t count; uint8_t weight; @@ -77,27 +81,85 @@ struct host { }; /** - * State information. + * Information we keep per ipv4 source address. + */ +struct host4 { + struct host host; + __be32 saddr; +}; + +static struct host4 *host_to_host4(const struct host *h) +{ + return (struct host4 *)h; +} + +struct host6 { + struct host host; + struct in6_addr saddr; +}; + +/** + * State information for IPv4 portscan detection. * @list: list of source addresses * @hash: pointers into the list * @index: oldest entry to be replaced */ static struct { spinlock_t lock; - struct host list[LIST_SIZE]; + struct host4 list[LIST_SIZE]; struct host *hash[HASH_SIZE]; int index; } state; +#ifdef WITH_IPV6 +/** + * State information for IPv6 portscan detection. + * @list: list of source addresses + * @hash: pointers into the list + * @index: oldest entry to be replaced + */ +static struct { + spinlock_t lock; + struct host6 *list; + struct host **hash; + int index; +} state6; + +static struct host6 *host_to_host6(const struct host *h) +{ + return (struct host6 *) h; +} + +/** + * allocate state6 memory only when needed + */ +static bool state6_alloc_mem(void) +{ + if (state6.hash != NULL) + return true; + + state6.list = vzalloc(LIST_SIZE * sizeof(struct host6)); + if (state6.list == NULL) + return false; + + state6.hash = vzalloc(HASH_SIZE * sizeof(struct host*)); + if (state6.hash == NULL) { + vfree(state6.list); + return false; + } + return true; +} +#endif + /* * Convert an IP address into a hash table index. */ -static inline int hashfunc(struct in_addr addr) +static unsigned int hashfunc(__be32 addr) { unsigned int value; - int hash; + unsigned int hash; - value = addr.s_addr; + value = addr; hash = 0; do { hash ^= value; @@ -106,133 +168,169 @@ static inline int hashfunc(struct in_addr addr) return hash & (HASH_SIZE - 1); } -static bool -xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match) +static inline unsigned int hashfunc6(const struct in6_addr *addr) +{ + __be32 h = addr->s6_addr32[0] ^ addr->s6_addr32[1]; + return hashfunc(h ^ addr->s6_addr32[2] ^ addr->s6_addr32[3]); +} + +static bool port_in_list(struct host *host, uint8_t proto, uint16_t port) +{ + unsigned int i; + + for (i = 0; i < host->count; ++i) { + if (host->ports[i].proto != proto) + continue; + if (host->ports[i].number == port) + return true; + } + return false; +} + +static uint16_t get_port_weight(const struct xt_psd_info *psd, __be16 port) +{ + return ntohs(port) < 1024 ? psd->lo_ports_weight : psd->hi_ports_weight; +} + +static bool +is_portscan(struct host *host, const struct xt_psd_info *psdinfo, + const struct tcphdr *tcph, uint8_t proto) +{ + if (port_in_list(host, proto, tcph->dest)) + return false; + + /* + * TCP/ACK and/or TCP/RST to a new port? This could be an + * outgoing connection. + */ + if (proto == IPPROTO_TCP && (tcph->ack || tcph->rst)) + return false; + + host->timestamp = jiffies; + + if (host->weight >= psdinfo->weight_threshold) /* already matched */ + return true; + + /* Update the total weight */ + host->weight += get_port_weight(psdinfo, tcph->dest); + + /* Got enough destination ports to decide that this is a scan? */ + if (host->weight >= psdinfo->weight_threshold) + return true; + + /* Remember the new port */ + if (host->count < ARRAY_SIZE(host->ports)) { + host->ports[host->count].number = tcph->dest; + host->ports[host->count].proto = proto; + host->count++; + } + return false; +} + +static struct host *host_get_next(struct host *h, struct host **last) +{ + if (h->next != NULL) + *last = h; + return h->next; +} + +static void ht_unlink(struct host **head, struct host *last) +{ + if (last != NULL) + last->next = last->next->next; + else if (*head != NULL) + *head = (*head)->next; +} + +static bool +entry_is_recent(const struct host *h, unsigned long delay_threshold, + unsigned long now) +{ + return now - h->timestamp <= (delay_threshold * HZ) / 100 && + time_after_eq(now, h->timestamp); +} + +static void remove_oldest(struct host **head, struct host *curr) +{ + struct host *h, *last = NULL; + + /* + * We are going to re-use the oldest list entry, so remove it from the + * hash table first, if it is really already in use. + */ + h = *head; + while (h != NULL) { + if (curr == h) + break; + last = h; + h = h->next; + } + + /* Then, remove it */ + if (h != NULL) + ht_unlink(head, last); +} + +static void * +get_header_pointer4(const struct sk_buff *skb, unsigned int thoff, void *mem) +{ + const struct iphdr *iph = ip_hdr(skb); + int hdrlen; + + switch (iph->protocol) { + case IPPROTO_TCP: + hdrlen = sizeof(struct tcphdr); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + hdrlen = sizeof(struct udphdr); + break; + default: + return NULL; + } + + return skb_header_pointer(skb, thoff, hdrlen, mem); +} + +static bool +handle_packet4(const struct iphdr *iph, const struct tcphdr *tcph, + const struct xt_psd_info *psdinfo, unsigned int hash) { - const struct iphdr *iph; - const struct tcphdr *tcph = NULL; - const struct udphdr *udph; - union { - struct tcphdr tcph; - struct udphdr udph; - } _buf; - struct in_addr addr; - u_int16_t src_port,dest_port; - u_int8_t proto; unsigned long now; - struct host *curr, *last, **head; - int hash, index, count; - /* Parameters from userspace */ - const struct xt_psd_info *psdinfo = match->matchinfo; - - iph = ip_hdr(pskb); - if (iph->frag_off & htons(IP_OFFSET)) { - pr_debug("sanity check failed\n"); - return false; - } - - proto = iph->protocol; - addr.s_addr = iph->saddr; - /* We're using IP address 0.0.0.0 for a special purpose here, so don't let - * them spoof us. [DHCP needs this feature - HW] */ - if (addr.s_addr == 0) { - pr_debug("spoofed source address (0.0.0.0)\n"); - return false; - } - - if (proto == IPPROTO_TCP) { - tcph = skb_header_pointer(pskb, match->thoff, - sizeof(_buf.tcph), &_buf.tcph); - if (tcph == NULL) - return false; - - /* Yep, it's dirty */ - src_port = tcph->source; - dest_port = tcph->dest; - } else if (proto == IPPROTO_UDP || proto == IPPROTO_UDPLITE) { - udph = skb_header_pointer(pskb, match->thoff, - sizeof(_buf.udph), &_buf.udph); - if (udph == NULL) - return false; - src_port = udph->source; - dest_port = udph->dest; - } else { - pr_debug("protocol not supported\n"); - return false; - } + struct host *curr, *last = NULL, **head; + struct host4 *curr4; + int count = 0; now = jiffies; - - spin_lock(&state.lock); + head = &state.hash[hash]; /* Do we know this source address already? */ - count = 0; - last = NULL; - if ((curr = *(head = &state.hash[hash = hashfunc(addr)])) != NULL) - do { - if (curr->src_addr.s_addr == addr.s_addr) - break; - count++; - if (curr->next != NULL) - last = curr; - } while ((curr = curr->next) != NULL); + curr = *head; + while (curr != NULL) { + curr4 = host_to_host4(curr); + if (curr4->saddr == iph->saddr) + break; + count++; + curr = host_get_next(curr, &last); + } if (curr != NULL) { /* We know this address, and the entry isn't too old. Update it. */ - if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 && - time_after_eq(now, curr->timestamp)) { - - /* Just update the appropriate list entry if we've seen this port already */ - for (index = 0; index < curr->count; index++) { - if (curr->ports[index].number == dest_port) { - curr->ports[index].proto = proto; - goto out_no_match; - } - } - - /* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */ - if (proto == IPPROTO_TCP && (tcph->ack || tcph->rst)) - goto out_no_match; - - /* Packet to a new port, and not TCP/ACK: update the timestamp */ - curr->timestamp = now; - - /* Matched this scan already? Then Leave. */ - if (curr->weight >= psdinfo->weight_threshold) - goto out_match; - - /* Update the total weight */ - curr->weight += (ntohs(dest_port) < 1024) ? - psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; - - /* Got enough destination ports to decide that this is a scan? */ - if (curr->weight >= psdinfo->weight_threshold) - goto out_match; - - /* Remember the new port */ - if (curr->count < ARRAY_SIZE(curr->ports)) { - curr->ports[curr->count].number = dest_port; - curr->ports[curr->count].proto = proto; - curr->count++; - } - - goto out_no_match; - } + if (entry_is_recent(curr, psdinfo->delay_threshold, now)) + return is_portscan(curr, psdinfo, tcph, iph->protocol); /* We know this address, but the entry is outdated. Mark it unused, and * remove from the hash table. We'll allocate a new entry instead since * this one might get re-used too soon. */ - curr->src_addr.s_addr = 0; - if (last != NULL) - last->next = last->next->next; - else if (*head != NULL) - *head = (*head)->next; + curr4 = host_to_host4(curr); + curr4->saddr = 0; + ht_unlink(head, last); last = NULL; } /* We don't need an ACK from a new source address */ - if (proto == IPPROTO_TCP && tcph->ack) - goto out_no_match; + if (iph->protocol == IPPROTO_TCP && tcph->ack) + return false; /* Got too many source addresses with the same hash value? Then remove the * oldest one from the hash table, so that they can't take too much of our @@ -240,33 +338,15 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match) if (count >= HASH_MAX && last != NULL) last->next = NULL; - /* We're going to re-use the oldest list entry, so remove it from the hash - * table first (if it is really already in use, and isn't removed from the - * hash table already because of the HASH_MAX check above). */ - - /* First, find it */ - if (state.list[state.index].src_addr.s_addr != 0) - head = &state.hash[hashfunc(state.list[state.index].src_addr)]; + if (state.list[state.index].saddr != 0) + head = &state.hash[hashfunc(state.list[state.index].saddr)]; else head = &last; - last = NULL; - if ((curr = *head) != NULL) - do { - if (curr == &state.list[state.index]) - break; - last = curr; - } while ((curr = curr->next) != NULL); - - /* Then, remove it */ - if (curr != NULL) { - if (last != NULL) - last->next = last->next->next; - else if (*head != NULL) - *head = (*head)->next; - } /* Get our list entry */ - curr = &state.list[state.index++]; + curr4 = &state.list[state.index++]; + curr = &curr4->host; + remove_oldest(head, curr); if (state.index >= LIST_SIZE) state.index = 0; @@ -276,24 +356,173 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match) *head = curr; /* And fill in the fields */ + curr4 = host_to_host4(curr); + curr4->saddr = iph->saddr; curr->timestamp = now; - curr->src_addr = addr; - curr->dest_addr.s_addr = iph->daddr; - curr->src_port = src_port; curr->count = 1; - curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; - curr->ports[0].number = dest_port; - curr->ports[0].proto = proto; - -out_no_match: - spin_unlock(&state.lock); + curr->weight = get_port_weight(psdinfo, tcph->dest); + curr->ports[0].number = tcph->dest; + curr->ports[0].proto = iph->protocol; return false; - -out_match: - spin_unlock(&state.lock); - return true; } +static bool +xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match) +{ + struct iphdr *iph = ip_hdr(pskb); + struct tcphdr _tcph; + struct tcphdr *tcph; + bool matched; + unsigned int hash; + /* Parameters from userspace */ + const struct xt_psd_info *psdinfo = match->matchinfo; + + if (iph->frag_off & htons(IP_OFFSET)) { + pr_debug("sanity check failed\n"); + return false; + } + + /* + * We are using IP address 0.0.0.0 for a special purpose here, so do + * not let them spoof us. [DHCP needs this feature - HW] + */ + if (iph->saddr == 0) { + pr_debug("spoofed source address (0.0.0.0)\n"); + return false; + } + + tcph = get_header_pointer4(pskb, match->thoff, &_tcph); + if (tcph == NULL) + return false; + + hash = hashfunc(iph->saddr); + + spin_lock(&state.lock); + matched = handle_packet4(iph, tcph, psdinfo, hash); + spin_unlock(&state.lock); + return matched; +} + +#ifdef WITH_IPV6 +static bool +handle_packet6(const struct ipv6hdr *ip6h, const struct tcphdr *tcph, + const struct xt_psd_info *psdinfo, uint8_t proto, int hash) +{ + unsigned long now; + struct host *curr, *last = NULL, **head; + struct host6 *curr6; + int count = 0; + + now = jiffies; + head = &state6.hash[hash]; + + curr = *head; + while (curr != NULL) { + curr6 = host_to_host6(curr); + if (ipv6_addr_equal(&curr6->saddr, &ip6h->saddr)) + break; + count++; + curr = host_get_next(curr, &last); + } + + if (curr != NULL) { + if (entry_is_recent(curr, psdinfo->delay_threshold, now)) + return is_portscan(curr, psdinfo, tcph, proto); + curr6 = host_to_host6(curr); + memset(&curr6->saddr, 0, sizeof(curr6->saddr)); + ht_unlink(head, last); + last = NULL; + } + + if (proto == IPPROTO_TCP && tcph->ack) + return false; + + if (count >= HASH_MAX && last != NULL) + last->next = NULL; + + if (!ipv6_addr_any(&state6.list[state6.index].saddr)) + head = &state6.hash[hashfunc6(&state6.list[state6.index].saddr)]; + else + head = &last; + + curr6 = &state6.list[state6.index++]; + curr = &curr6->host; + remove_oldest(head, curr); + if (state6.index >= LIST_SIZE) + state6.index = 0; + + head = &state6.hash[hash]; + curr->next = *head; + *head = curr; + + curr6 = host_to_host6(curr); + curr6->saddr = ip6h->saddr; + curr->timestamp = now; + curr->count = 1; + curr->weight = get_port_weight(psdinfo, tcph->dest); + curr->ports[0].number = tcph->dest; + curr->ports[0].proto = proto; + return false; +} + +static void * +get_header_pointer6(const struct sk_buff *skb, void *mem, uint8_t *proto) +{ + static const uint8_t types[] = {IPPROTO_TCP, + IPPROTO_UDP, IPPROTO_UDPLITE}; + unsigned int i, offset = 0; + int err; + size_t hdrlen; + + for (i = 0; i < ARRAY_SIZE(types); ++i) { + err = ipv6_find_hdr(skb, &offset, types[i], NULL, NULL); + if (err < 0) + continue; + + switch (types[i]) { + case IPPROTO_TCP: + hdrlen = sizeof(struct tcphdr); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + hdrlen = sizeof(struct udphdr); + break; + default: + return NULL; + } + *proto = types[i]; + return skb_header_pointer(skb, offset, hdrlen, mem); + } + return NULL; +} + +static bool +xt_psd_match6(const struct sk_buff *pskb, struct xt_action_param *match) +{ + const struct ipv6hdr *ip6h = ipv6_hdr(pskb); + struct tcphdr _tcph; + struct tcphdr *tcph; + uint8_t proto = 0; + bool matched; + int hash; + const struct xt_psd_info *psdinfo = match->matchinfo; + + if (ipv6_addr_any(&ip6h->saddr)) + return false; + + tcph = get_header_pointer6(pskb, &_tcph, &proto); + if (tcph == NULL) + return false; + + hash = hashfunc6(&ip6h->saddr); + + spin_lock(&state6.lock); + matched = handle_packet6(ip6h, tcph, psdinfo, proto, hash); + spin_unlock(&state6.lock); + return matched; +} +#endif + static int psd_mt_check(const struct xt_mtchk_param *par) { const struct xt_psd_info *info = par->matchinfo; @@ -315,25 +544,53 @@ static int psd_mt_check(const struct xt_mtchk_param *par) return 0; } -static struct xt_match xt_psd_reg __read_mostly = { - .name = "psd", - .family = NFPROTO_IPV4, - .revision = 1, - .checkentry = psd_mt_check, - .match = xt_psd_match, - .matchsize = sizeof(struct xt_psd_info), - .me = THIS_MODULE, +#ifdef WITH_IPV6 +static int psd_mt_check6(const struct xt_mtchk_param *par) +{ + if (!state6_alloc_mem()) + return -ENOMEM; + return psd_mt_check(par); +} +#endif + +static struct xt_match xt_psd_reg[] __read_mostly = { + { + .name = "psd", + .family = NFPROTO_IPV4, + .revision = 1, + .checkentry = psd_mt_check, + .match = xt_psd_match, + .matchsize = sizeof(struct xt_psd_info), + .me = THIS_MODULE, +#ifdef WITH_IPV6 + }, { + .name = "psd", + .family = NFPROTO_IPV6, + .revision = 1, + .checkentry = psd_mt_check6, + .match = xt_psd_match6, + .matchsize = sizeof(struct xt_psd_info), + .me = THIS_MODULE, +#endif + } }; static int __init xt_psd_init(void) { spin_lock_init(&(state.lock)); - return xt_register_match(&xt_psd_reg); +#ifdef WITH_IPV6 + spin_lock_init(&(state6.lock)); +#endif + return xt_register_matches(xt_psd_reg, ARRAY_SIZE(xt_psd_reg)); } static void __exit xt_psd_exit(void) { - xt_unregister_match(&xt_psd_reg); + xt_unregister_matches(xt_psd_reg, ARRAY_SIZE(xt_psd_reg)); +#ifdef WITH_IPV6 + vfree(state6.list); + vfree(state6.hash); +#endif } module_init(xt_psd_init);