anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-08 13:44:56 +02:00
Code Issues Releases Wiki Activity

Merge branch 'psd'

Browse Source
This commit is contained in:
Jan Engelhardt
2012-09-18 07:33:00 +02:00
parent 35ce1adf5e 3a6e73e986
commit 255a310536
2 changed files with 425 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
extensions/libxt_psd.c
View File

@@ -142,7 +142,7 @@ static struct xtables_match psd_mt_reg = {
.name = "psd", .name = "psd",
.version = XTABLES_VERSION, .version = XTABLES_VERSION,
.revision = 1, .revision = 1,
.family = NFPROTO_IPV4, .family = NFPROTO_UNSPEC,
.size = XT_ALIGN(sizeof(struct xt_psd_info)), .size = XT_ALIGN(sizeof(struct xt_psd_info)),
.userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)), .userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)),
.help = psd_mt_help, .help = psd_mt_help,

591
extensions/xt_psd.c
View File

@@ -22,13 +22,14 @@
#define pr_fmt(x) KBUILD_MODNAME ": " x #define pr_fmt(x) KBUILD_MODNAME ": " x
#include <linux/module.h> #include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
#include <linux/ip.h> #include <linux/types.h>
#include <net/tcp.h> #include <linux/tcp.h>
#include <linux/spinlock.h> #include <linux/spinlock.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter/x_tables.h> #include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include "xt_psd.h" #include "xt_psd.h"
#include "compat_xtables.h" #include "compat_xtables.h"
@@ -39,6 +40,7 @@ MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com>"); MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com>");
MODULE_DESCRIPTION("Xtables: PSD - portscan detection"); MODULE_DESCRIPTION("Xtables: PSD - portscan detection");
MODULE_ALIAS("ipt_psd"); MODULE_ALIAS("ipt_psd");
MODULE_ALIAS("ip6t_psd");
/* /*
* Keep track of up to LIST_SIZE source addresses, using a hash table of * Keep track of up to LIST_SIZE source addresses, using a hash table of
@@ -50,6 +52,10 @@ MODULE_ALIAS("ipt_psd");
#define HASH_SIZE (1 << HASH_LOG) #define HASH_SIZE (1 << HASH_LOG)
#define HASH_MAX 0x10 #define HASH_MAX 0x10
#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
# define WITH_IPV6 1
#endif
/* /*
* Information we keep per each target port * Information we keep per each target port
*/ */
@@ -68,8 +74,6 @@ struct port {
struct host { struct host {
struct host *next; struct host *next;
unsigned long timestamp; unsigned long timestamp;
struct in_addr src_addr;
struct in_addr dest_addr;
__be16 src_port; __be16 src_port;
uint16_t count; uint16_t count;
uint8_t weight; uint8_t weight;
@@ -77,27 +81,85 @@ struct host {
}; };
/** /**
* State information. * Information we keep per ipv4 source address.
*/
struct host4 {
struct host host;
__be32 saddr;
};
static struct host4 *host_to_host4(const struct host *h)
{
return (struct host4 *)h;
}
struct host6 {
struct host host;
struct in6_addr saddr;
};
/**
* State information for IPv4 portscan detection.
* @list: list of source addresses * @list: list of source addresses
* @hash: pointers into the list * @hash: pointers into the list
* @index: oldest entry to be replaced * @index: oldest entry to be replaced
*/ */
static struct { static struct {
spinlock_t lock; spinlock_t lock;
struct host list[LIST_SIZE]; struct host4 list[LIST_SIZE];
struct host *hash[HASH_SIZE]; struct host *hash[HASH_SIZE];
int index; int index;
} state; } state;
#ifdef WITH_IPV6
/**
* State information for IPv6 portscan detection.
* @list: list of source addresses
* @hash: pointers into the list
* @index: oldest entry to be replaced
*/
static struct {
spinlock_t lock;
struct host6 *list;
struct host **hash;
int index;
} state6;
static struct host6 *host_to_host6(const struct host *h)
{
return (struct host6 *) h;
}
/**
* allocate state6 memory only when needed
*/
static bool state6_alloc_mem(void)
{
if (state6.hash != NULL)
return true;
state6.list = vzalloc(LIST_SIZE * sizeof(struct host6));
if (state6.list == NULL)
return false;
state6.hash = vzalloc(HASH_SIZE * sizeof(struct host*));
if (state6.hash == NULL) {
vfree(state6.list);
return false;
}
return true;
}
#endif
/* /*
* Convert an IP address into a hash table index. * Convert an IP address into a hash table index.
*/ */
static inline int hashfunc(struct in_addr addr) static unsigned int hashfunc(__be32 addr)
{ {
unsigned int value; unsigned int value;
int hash; unsigned int hash;
value = addr.s_addr; value = addr;
hash = 0; hash = 0;
do { do {
hash ^= value; hash ^= value;
@@ -106,133 +168,169 @@ static inline int hashfunc(struct in_addr addr)
return hash & (HASH_SIZE - 1); return hash & (HASH_SIZE - 1);
} }
static bool static inline unsigned int hashfunc6(const struct in6_addr *addr)
xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match) {
__be32 h = addr->s6_addr32[0] ^ addr->s6_addr32[1];
return hashfunc(h ^ addr->s6_addr32[2] ^ addr->s6_addr32[3]);
}
static bool port_in_list(struct host *host, uint8_t proto, uint16_t port)
{
unsigned int i;
for (i = 0; i < host->count; ++i) {
if (host->ports[i].proto != proto)
continue;
if (host->ports[i].number == port)
return true;
}
return false;
}
static uint16_t get_port_weight(const struct xt_psd_info *psd, __be16 port)
{
return ntohs(port) < 1024 ? psd->lo_ports_weight : psd->hi_ports_weight;
}
static bool
is_portscan(struct host *host, const struct xt_psd_info *psdinfo,
const struct tcphdr *tcph, uint8_t proto)
{
if (port_in_list(host, proto, tcph->dest))
return false;
/*
* TCP/ACK and/or TCP/RST to a new port? This could be an
* outgoing connection.
*/
if (proto == IPPROTO_TCP && (tcph->ack || tcph->rst))
return false;
host->timestamp = jiffies;
if (host->weight >= psdinfo->weight_threshold) /* already matched */
return true;
/* Update the total weight */
host->weight += get_port_weight(psdinfo, tcph->dest);
/* Got enough destination ports to decide that this is a scan? */
if (host->weight >= psdinfo->weight_threshold)
return true;
/* Remember the new port */
if (host->count < ARRAY_SIZE(host->ports)) {
host->ports[host->count].number = tcph->dest;
host->ports[host->count].proto = proto;
host->count++;
}
return false;
}
static struct host *host_get_next(struct host *h, struct host **last)
{
if (h->next != NULL)
*last = h;
return h->next;
}
static void ht_unlink(struct host **head, struct host *last)
{
if (last != NULL)
last->next = last->next->next;
else if (*head != NULL)
*head = (*head)->next;
}
static bool
entry_is_recent(const struct host *h, unsigned long delay_threshold,
unsigned long now)
{
return now - h->timestamp <= (delay_threshold * HZ) / 100 &&
time_after_eq(now, h->timestamp);
}
static void remove_oldest(struct host **head, struct host *curr)
{
struct host *h, *last = NULL;
/*
* We are going to re-use the oldest list entry, so remove it from the
* hash table first, if it is really already in use.
*/
h = *head;
while (h != NULL) {
if (curr == h)
break;
last = h;
h = h->next;
}
/* Then, remove it */
if (h != NULL)
ht_unlink(head, last);
}
static void *
get_header_pointer4(const struct sk_buff *skb, unsigned int thoff, void *mem)
{
const struct iphdr *iph = ip_hdr(skb);
int hdrlen;
switch (iph->protocol) {
case IPPROTO_TCP:
hdrlen = sizeof(struct tcphdr);
break;
case IPPROTO_UDP:
case IPPROTO_UDPLITE:
hdrlen = sizeof(struct udphdr);
break;
default:
return NULL;
}
return skb_header_pointer(skb, thoff, hdrlen, mem);
}
static bool
handle_packet4(const struct iphdr *iph, const struct tcphdr *tcph,
const struct xt_psd_info *psdinfo, unsigned int hash)
{ {
const struct iphdr *iph;
const struct tcphdr *tcph = NULL;
const struct udphdr *udph;
union {
struct tcphdr tcph;
struct udphdr udph;
} _buf;
struct in_addr addr;
u_int16_t src_port,dest_port;
u_int8_t proto;
unsigned long now; unsigned long now;
struct host *curr, *last, **head; struct host *curr, *last = NULL, **head;
int hash, index, count; struct host4 *curr4;
/* Parameters from userspace */ int count = 0;
const struct xt_psd_info *psdinfo = match->matchinfo;
iph = ip_hdr(pskb);
if (iph->frag_off & htons(IP_OFFSET)) {
pr_debug("sanity check failed\n");
return false;
}
proto = iph->protocol;
addr.s_addr = iph->saddr;
/* We're using IP address 0.0.0.0 for a special purpose here, so don't let
* them spoof us. [DHCP needs this feature - HW] */
if (addr.s_addr == 0) {
pr_debug("spoofed source address (0.0.0.0)\n");
return false;
}
if (proto == IPPROTO_TCP) {
tcph = skb_header_pointer(pskb, match->thoff,
sizeof(_buf.tcph), &_buf.tcph);
if (tcph == NULL)
return false;
/* Yep, it's dirty */
src_port = tcph->source;
dest_port = tcph->dest;
} else if (proto == IPPROTO_UDP || proto == IPPROTO_UDPLITE) {
udph = skb_header_pointer(pskb, match->thoff,
sizeof(_buf.udph), &_buf.udph);
if (udph == NULL)
return false;
src_port = udph->source;
dest_port = udph->dest;
} else {
pr_debug("protocol not supported\n");
return false;
}
now = jiffies; now = jiffies;
head = &state.hash[hash];
spin_lock(&state.lock);
/* Do we know this source address already? */ /* Do we know this source address already? */
count = 0; curr = *head;
last = NULL; while (curr != NULL) {
if ((curr = *(head = &state.hash[hash = hashfunc(addr)])) != NULL) curr4 = host_to_host4(curr);
do { if (curr4->saddr == iph->saddr)
if (curr->src_addr.s_addr == addr.s_addr) break;
break; count++;
count++; curr = host_get_next(curr, &last);
if (curr->next != NULL) }
last = curr;
} while ((curr = curr->next) != NULL);
if (curr != NULL) { if (curr != NULL) {
/* We know this address, and the entry isn't too old. Update it. */ /* We know this address, and the entry isn't too old. Update it. */
if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 && if (entry_is_recent(curr, psdinfo->delay_threshold, now))
time_after_eq(now, curr->timestamp)) { return is_portscan(curr, psdinfo, tcph, iph->protocol);
/* Just update the appropriate list entry if we've seen this port already */
for (index = 0; index < curr->count; index++) {
if (curr->ports[index].number == dest_port) {
curr->ports[index].proto = proto;
goto out_no_match;
}
}
/* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */
if (proto == IPPROTO_TCP && (tcph->ack || tcph->rst))
goto out_no_match;
/* Packet to a new port, and not TCP/ACK: update the timestamp */
curr->timestamp = now;
/* Matched this scan already? Then Leave. */
if (curr->weight >= psdinfo->weight_threshold)
goto out_match;
/* Update the total weight */
curr->weight += (ntohs(dest_port) < 1024) ?
psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
/* Got enough destination ports to decide that this is a scan? */
if (curr->weight >= psdinfo->weight_threshold)
goto out_match;
/* Remember the new port */
if (curr->count < ARRAY_SIZE(curr->ports)) {
curr->ports[curr->count].number = dest_port;
curr->ports[curr->count].proto = proto;
curr->count++;
}
goto out_no_match;
}
/* We know this address, but the entry is outdated. Mark it unused, and /* We know this address, but the entry is outdated. Mark it unused, and
* remove from the hash table. We'll allocate a new entry instead since * remove from the hash table. We'll allocate a new entry instead since
* this one might get re-used too soon. */ * this one might get re-used too soon. */
curr->src_addr.s_addr = 0; curr4 = host_to_host4(curr);
if (last != NULL) curr4->saddr = 0;
last->next = last->next->next; ht_unlink(head, last);
else if (*head != NULL)
*head = (*head)->next;
last = NULL; last = NULL;
} }
/* We don't need an ACK from a new source address */ /* We don't need an ACK from a new source address */
if (proto == IPPROTO_TCP && tcph->ack) if (iph->protocol == IPPROTO_TCP && tcph->ack)
goto out_no_match; return false;
/* Got too many source addresses with the same hash value? Then remove the /* Got too many source addresses with the same hash value? Then remove the
* oldest one from the hash table, so that they can't take too much of our * oldest one from the hash table, so that they can't take too much of our
@@ -240,33 +338,15 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
if (count >= HASH_MAX && last != NULL) if (count >= HASH_MAX && last != NULL)
last->next = NULL; last->next = NULL;
/* We're going to re-use the oldest list entry, so remove it from the hash if (state.list[state.index].saddr != 0)
* table first (if it is really already in use, and isn't removed from the head = &state.hash[hashfunc(state.list[state.index].saddr)];
* hash table already because of the HASH_MAX check above). */
/* First, find it */
if (state.list[state.index].src_addr.s_addr != 0)
head = &state.hash[hashfunc(state.list[state.index].src_addr)];
else else
head = &last; head = &last;
last = NULL;
if ((curr = *head) != NULL)
do {
if (curr == &state.list[state.index])
break;
last = curr;
} while ((curr = curr->next) != NULL);
/* Then, remove it */
if (curr != NULL) {
if (last != NULL)
last->next = last->next->next;
else if (*head != NULL)
*head = (*head)->next;
}
/* Get our list entry */ /* Get our list entry */
curr = &state.list[state.index++]; curr4 = &state.list[state.index++];
curr = &curr4->host;
remove_oldest(head, curr);
if (state.index >= LIST_SIZE) if (state.index >= LIST_SIZE)
state.index = 0; state.index = 0;
@@ -276,24 +356,173 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
*head = curr; *head = curr;
/* And fill in the fields */ /* And fill in the fields */
curr4 = host_to_host4(curr);
curr4->saddr = iph->saddr;
curr->timestamp = now; curr->timestamp = now;
curr->src_addr = addr;
curr->dest_addr.s_addr = iph->daddr;
curr->src_port = src_port;
curr->count = 1; curr->count = 1;
curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; curr->weight = get_port_weight(psdinfo, tcph->dest);
curr->ports[0].number = dest_port; curr->ports[0].number = tcph->dest;
curr->ports[0].proto = proto; curr->ports[0].proto = iph->protocol;
out_no_match:
spin_unlock(&state.lock);
return false; return false;
out_match:
spin_unlock(&state.lock);
return true;
} }
static bool
xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
{
struct iphdr *iph = ip_hdr(pskb);
struct tcphdr _tcph;
struct tcphdr *tcph;
bool matched;
unsigned int hash;
/* Parameters from userspace */
const struct xt_psd_info *psdinfo = match->matchinfo;
if (iph->frag_off & htons(IP_OFFSET)) {
pr_debug("sanity check failed\n");
return false;
}
/*
* We are using IP address 0.0.0.0 for a special purpose here, so do
* not let them spoof us. [DHCP needs this feature - HW]
*/
if (iph->saddr == 0) {
pr_debug("spoofed source address (0.0.0.0)\n");
return false;
}
tcph = get_header_pointer4(pskb, match->thoff, &_tcph);
if (tcph == NULL)
return false;
hash = hashfunc(iph->saddr);
spin_lock(&state.lock);
matched = handle_packet4(iph, tcph, psdinfo, hash);
spin_unlock(&state.lock);
return matched;
}
#ifdef WITH_IPV6
static bool
handle_packet6(const struct ipv6hdr *ip6h, const struct tcphdr *tcph,
const struct xt_psd_info *psdinfo, uint8_t proto, int hash)
{
unsigned long now;
struct host *curr, *last = NULL, **head;
struct host6 *curr6;
int count = 0;
now = jiffies;
head = &state6.hash[hash];
curr = *head;
while (curr != NULL) {
curr6 = host_to_host6(curr);
if (ipv6_addr_equal(&curr6->saddr, &ip6h->saddr))
break;
count++;
curr = host_get_next(curr, &last);
}
if (curr != NULL) {
if (entry_is_recent(curr, psdinfo->delay_threshold, now))
return is_portscan(curr, psdinfo, tcph, proto);
curr6 = host_to_host6(curr);
memset(&curr6->saddr, 0, sizeof(curr6->saddr));
ht_unlink(head, last);
last = NULL;
}
if (proto == IPPROTO_TCP && tcph->ack)
return false;
if (count >= HASH_MAX && last != NULL)
last->next = NULL;
if (!ipv6_addr_any(&state6.list[state6.index].saddr))
head = &state6.hash[hashfunc6(&state6.list[state6.index].saddr)];
else
head = &last;
curr6 = &state6.list[state6.index++];
curr = &curr6->host;
remove_oldest(head, curr);
if (state6.index >= LIST_SIZE)
state6.index = 0;
head = &state6.hash[hash];
curr->next = *head;
*head = curr;
curr6 = host_to_host6(curr);
curr6->saddr = ip6h->saddr;
curr->timestamp = now;
curr->count = 1;
curr->weight = get_port_weight(psdinfo, tcph->dest);
curr->ports[0].number = tcph->dest;
curr->ports[0].proto = proto;
return false;
}
static void *
get_header_pointer6(const struct sk_buff *skb, void *mem, uint8_t *proto)
{
static const uint8_t types[] = {IPPROTO_TCP,
IPPROTO_UDP, IPPROTO_UDPLITE};
unsigned int i, offset = 0;
int err;
size_t hdrlen;
for (i = 0; i < ARRAY_SIZE(types); ++i) {
err = ipv6_find_hdr(skb, &offset, types[i], NULL, NULL);
if (err < 0)
continue;
switch (types[i]) {
case IPPROTO_TCP:
hdrlen = sizeof(struct tcphdr);
break;
case IPPROTO_UDP:
case IPPROTO_UDPLITE:
hdrlen = sizeof(struct udphdr);
break;
default:
return NULL;
}
*proto = types[i];
return skb_header_pointer(skb, offset, hdrlen, mem);
}
return NULL;
}
static bool
xt_psd_match6(const struct sk_buff *pskb, struct xt_action_param *match)
{
const struct ipv6hdr *ip6h = ipv6_hdr(pskb);
struct tcphdr _tcph;
struct tcphdr *tcph;
uint8_t proto = 0;
bool matched;
int hash;
const struct xt_psd_info *psdinfo = match->matchinfo;
if (ipv6_addr_any(&ip6h->saddr))
return false;
tcph = get_header_pointer6(pskb, &_tcph, &proto);
if (tcph == NULL)
return false;
hash = hashfunc6(&ip6h->saddr);
spin_lock(&state6.lock);
matched = handle_packet6(ip6h, tcph, psdinfo, proto, hash);
spin_unlock(&state6.lock);
return matched;
}
#endif
static int psd_mt_check(const struct xt_mtchk_param *par) static int psd_mt_check(const struct xt_mtchk_param *par)
{ {
const struct xt_psd_info *info = par->matchinfo; const struct xt_psd_info *info = par->matchinfo;
@@ -315,25 +544,53 @@ static int psd_mt_check(const struct xt_mtchk_param *par)
return 0; return 0;
} }
static struct xt_match xt_psd_reg __read_mostly = { #ifdef WITH_IPV6
.name = "psd", static int psd_mt_check6(const struct xt_mtchk_param *par)
.family = NFPROTO_IPV4, {
.revision = 1, if (!state6_alloc_mem())
.checkentry = psd_mt_check, return -ENOMEM;
.match = xt_psd_match, return psd_mt_check(par);
.matchsize = sizeof(struct xt_psd_info), }
.me = THIS_MODULE, #endif
static struct xt_match xt_psd_reg[] __read_mostly = {
{
.name = "psd",
.family = NFPROTO_IPV4,
.revision = 1,
.checkentry = psd_mt_check,
.match = xt_psd_match,
.matchsize = sizeof(struct xt_psd_info),
.me = THIS_MODULE,
#ifdef WITH_IPV6
}, {
.name = "psd",
.family = NFPROTO_IPV6,
.revision = 1,
.checkentry = psd_mt_check6,
.match = xt_psd_match6,
.matchsize = sizeof(struct xt_psd_info),
.me = THIS_MODULE,
#endif
}
}; };
static int __init xt_psd_init(void) static int __init xt_psd_init(void)
{ {
spin_lock_init(&(state.lock)); spin_lock_init(&(state.lock));
return xt_register_match(&xt_psd_reg); #ifdef WITH_IPV6
spin_lock_init(&(state6.lock));
#endif
return xt_register_matches(xt_psd_reg, ARRAY_SIZE(xt_psd_reg));
} }
static void __exit xt_psd_exit(void) static void __exit xt_psd_exit(void)
{ {
xt_unregister_match(&xt_psd_reg); xt_unregister_matches(xt_psd_reg, ARRAY_SIZE(xt_psd_reg));
#ifdef WITH_IPV6
vfree(state6.list);
vfree(state6.hash);
#endif
} }
module_init(xt_psd_init); module_init(xt_psd_init);