anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-06 04:35:12 +02:00
Code Issues Releases Wiki Activity

psd: import 20090807 code base

Browse Source
This commit is contained in:
Mohd Nawawi Mohamad Jamili
2009-08-07 16:18:49 +08:00
committed by Jan Engelhardt
parent 5aee8738ed
commit 2aa32d4bce
9 changed files with 575 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
doc/README.psd Normal file
View File

@@ -0,0 +1,4 @@
PSD (Portscan Detection) External extensions for Xtables-addons
Example:
iptables -A INPUT -m psd --psd-weight-threshold 21 --psd-delay-threshold 300 --psd-lo-ports-weight 1 --psd-hi-ports-weight 10 -j LOG --log-prefix "PSD: "

1
extensions/Kbuild.psd Normal file
View File

@@ -0,0 +1 @@
obj-${build_psd} += xt_psd.o

1
extensions/Mbuild.psd Normal file
View File

@@ -0,0 +1 @@
obj-${build_psd} += libxt_psd.so

166
extensions/libxt_psd.c Normal file
View File

@@ -0,0 +1,166 @@
/*
Shared library add-on to iptables to add PSD support
Copyright (C) 2000,2001 astaro AG
This file is distributed under the terms of the GNU General Public
License (GPL). Copies of the GPL can be obtained from:
ftp://prep.ai.mit.edu/pub/gnu/GPL
2000-05-04 Markus Hennig <hennig@astaro.de> : initial
2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
2003-03-02 Harald Welte <laforge@netfilter.org>: fix 'storage' bug
2008-04-03 Mohd Nawawi <nawawi@tracenetworkcorporation.com>: update to 2.6.24 / 1.4 code
2008-06-24 Mohd Nawawi <nawawi@tracenetworkcorporation.com>: update to 2.6.24 / 1.4.1 code
2009-08-07 Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com> : ported to xtables-addons
*/
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <netdb.h>
#include <string.h>
#include <stdlib.h>
#include <syslog.h>
#include <getopt.h>
#include <xtables.h>
#include <linux/netfilter/x_tables.h>
#include "xt_psd.h"
/* Function which prints out usage message. */
static void psd_mt_help(void) {
printf(
"psd match options:\n"
" --psd-weight-threshold threshhold Portscan detection weight threshold\n"
" --psd-delay-threshold delay Portscan detection delay threshold\n"
" --psd-lo-ports-weight lo Privileged ports weight\n"
" --psd-hi-ports-weight hi High ports weight\n\n");
}
static const struct option psd_mt_opts[] = {
{.name = "psd-weight-threshold", .has_arg = true, .val = '1'},
{.name = "psd-delay-threshold", .has_arg = true, .val = '2'},
{.name = "psd-lo-ports-weight", .has_arg = true, .val = '3'},
{.name = "psd-hi-ports-weight", .has_arg = true, .val = '4'},
{NULL}
};
/* Initialize the target. */
static void psd_mt_init(struct xt_entry_match *match) {
struct xt_psd_info *psdinfo = (struct xt_psd_info *)match->data;
psdinfo->weight_threshold = SCAN_WEIGHT_THRESHOLD;
psdinfo->delay_threshold = SCAN_DELAY_THRESHOLD;
psdinfo->lo_ports_weight = PORT_WEIGHT_PRIV;
psdinfo->hi_ports_weight = PORT_WEIGHT_HIGH;
}
#define XT_PSD_OPT_CTRESH 0x01
#define XT_PSD_OPT_DTRESH 0x02
#define XT_PSD_OPT_LPWEIGHT 0x04
#define XT_PSD_OPT_HPWEIGHT 0x08
static int psd_mt_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match)
{
struct xt_psd_info *psdinfo = (struct xt_psd_info *)(*match)->data;
unsigned int num;
switch (c) {
/* PSD-weight-threshold */
case '1':
if(*flags & XT_PSD_OPT_CTRESH) {
xtables_error(PARAMETER_PROBLEM,"Can't specify --psd-weight-threshold twice");
}
if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) {
xtables_error(PARAMETER_PROBLEM, "bad --psd-weight-threshold '%s'", optarg);
}
psdinfo->weight_threshold = num;
*flags |= XT_PSD_OPT_CTRESH;
return true;
/* PSD-delay-threshold */
case '2':
if(*flags & XT_PSD_OPT_DTRESH) {
xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-delay-threshold twice");
}
if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) {
xtables_error(PARAMETER_PROBLEM,"bad --psd-delay-threshold '%s'", optarg);
}
psdinfo->delay_threshold = num;
*flags |= XT_PSD_OPT_DTRESH;
return true;
/* PSD-lo-ports-weight */
case '3':
if(*flags & XT_PSD_OPT_LPWEIGHT) {
xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-lo-ports-weight twice");
}
if(!xtables_strtoui(optarg, NULL,&num,0,PSD_MAX_RATE)) {
xtables_error(PARAMETER_PROBLEM,"bad --psd-lo-ports-weight '%s'", optarg);
}
psdinfo->lo_ports_weight = num;
*flags |= XT_PSD_OPT_LPWEIGHT;
return true;
/* PSD-hi-ports-weight */
case '4':
if(*flags & XT_PSD_OPT_HPWEIGHT) {
xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-hi-ports-weight twice");
}
if(!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) {
xtables_error(PARAMETER_PROBLEM, "bad --psd-hi-ports-weight '%s'", optarg);
}
psdinfo->hi_ports_weight = num;
*flags |= XT_PSD_OPT_HPWEIGHT;
return true;
}
return false;
}
/* Final check; nothing. */
static void psd_mt_final_check(unsigned int flags) {}
/* Prints out the targinfo. */
static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
{
const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data;
printf("psd ");
printf("weight-threshold: %u ", psdinfo->weight_threshold);
printf("delay-threshold: %u ", psdinfo->delay_threshold);
printf("lo-ports-weight: %u ", psdinfo->lo_ports_weight);
printf("hi-ports-weight: %u ", psdinfo->hi_ports_weight);
}
/* Saves the union ipt_targinfo in parsable form to stdout. */
static void psd_mt_save(const void *ip, const struct xt_entry_match *match)
{
const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data;
printf("--psd-weight-threshold %u ", psdinfo->weight_threshold);
printf("--psd-delay-threshold %u ", psdinfo->delay_threshold);
printf("--psd-lo-ports-weight %u ", psdinfo->lo_ports_weight);
printf("--psd-hi-ports-weight %u ", psdinfo->hi_ports_weight);
}
static struct xtables_match psd_mt_reg = {
.name = "psd",
.version = XTABLES_VERSION,
.revision = 1,
.family = PF_INET,
.size = XT_ALIGN(sizeof(struct xt_psd_info)),
.userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)),
.help = psd_mt_help,
.init = psd_mt_init,
.parse = psd_mt_parse,
.final_check = psd_mt_final_check,
.print = psd_mt_print,
.save = psd_mt_save,
.extra_opts = psd_mt_opts,
};
static __attribute__((constructor)) void psd_mt_ldr(void)
{
xtables_register_match(&psd_mt_reg);
}

18
extensions/libxt_psd.man Normal file
View File

@@ -0,0 +1,18 @@
Attempt to detect TCP and UDP port scans. This match was derived from
Solar Designer's scanlogd.
.TP
.BI "--psd-weight-threshold " "threshold"
Total weight of the latest TCP/UDP packets with different
destination ports coming from the same host to be treated as port
scan sequence.
.TP
.BI "--psd-delay-threshold " "delay"
Delay (in hundredths of second) for the packets with different
destination ports coming from the same host to be treated as
possible port scan subsequence.
.TP
.BI "--psd-lo-ports-weight " "weight"
Weight of the packet with privileged (<=1024) destination port.
.TP
.BI "--psd-hi-ports-weight " "weight"
Weight of the packet with non-priviliged destination port.

6
extensions/xt_psd.Kconfig Normal file
View File

@@ -0,0 +1,6 @@
config NETFILTER_XT_MATCH_PSD
tristate 'psd match support'
depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
---help---
This option adds a `psd' match, which allows you to create rules in
any iptables table wich will detect TCP and UDP port scans.

336
extensions/xt_psd.c Normal file
View File

@@ -0,0 +1,336 @@
/*
This is a module which is used for PSD (portscan detection)
Derived from scanlogd v2.1 written by Solar Designer <solar@false.com>
and LOG target module.
Copyright (C) 2000,2001 astaro AG
This file is distributed under the terms of the GNU General Public
License (GPL). Copies of the GPL can be obtained from:
ftp://prep.ai.mit.edu/pub/gnu/GPL
2000-05-04 Markus Hennig <hennig@astaro.de> : initial
2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
2001-01-02 Dennis Koslowski <koslowski@astaro.de> : output modified
2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
2004-05-05 Martijn Lievaart <m@rtij.nl> : ported to 2.6
2007-04-05 Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com> : ported to 2.6.18
2008-03-21 Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com> : ported to 2.6.24
2009-08-07 Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com> : ported to xtables-addons
*/
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <net/tcp.h>
#include <linux/spinlock.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter/x_tables.h>
#include "xt_psd.h"
#include "compat_xtables.h"
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Dennis Koslowski <koslowski@astaro.com>");
MODULE_AUTHOR("Martijn Lievaart <m@rtij.nl>");
MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com>");
MODULE_DESCRIPTION("Xtables: PSD - portscan detection");
MODULE_ALIAS("ipt_psd");
#define HF_DADDR_CHANGING 0x01
#define HF_SPORT_CHANGING 0x02
#define HF_TOS_CHANGING 0x04
#define HF_TTL_CHANGING 0x08
/*
* Information we keep per each target port
*/
struct port {
u_int16_t number; /* port number */
u_int8_t proto; /* protocol number */
u_int8_t and_flags; /* tcp ANDed flags */
u_int8_t or_flags; /* tcp ORed flags */
};
/*
* Information we keep per each source address.
*/
struct host {
struct host *next; /* Next entry with the same hash */
clock_t timestamp; /* Last update time */
struct in_addr src_addr; /* Source address */
struct in_addr dest_addr; /* Destination address */
unsigned short src_port; /* Source port */
int count; /* Number of ports in the list */
int weight; /* Total weight of ports in the list */
struct port ports[SCAN_MAX_COUNT - 1]; /* List of ports */
unsigned char tos; /* TOS */
unsigned char ttl; /* TTL */
unsigned char flags; /* HF_ flags bitmask */
};
/*
* State information.
*/
static struct {
spinlock_t lock;
struct host list[LIST_SIZE]; /* List of source addresses */
struct host *hash[HASH_SIZE]; /* Hash: pointers into the list */
int index; /* Oldest entry to be replaced */
} state;
/*
* Convert an IP address into a hash table index.
*/
static inline int hashfunc(struct in_addr addr)
{
unsigned int value;
int hash;
value = addr.s_addr;
hash = 0;
do {
hash ^= value;
} while ((value >>= HASH_LOG));
return hash & (HASH_SIZE - 1);
}
static bool
xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match)
{
struct iphdr *ip_hdr;
struct tcphdr *tcp_hdr;
struct in_addr addr;
u_int16_t src_port,dest_port;
u_int8_t tcp_flags, proto;
clock_t now;
struct host *curr, *last, **head;
int hash, index, count;
/* Parameters from userspace */
const struct xt_psd_info *psdinfo = match->matchinfo;
/* IP header */
ip_hdr = (struct iphdr*) pskb->network_header;
/* Sanity check */
if (ntohs(ip_hdr->frag_off) & IP_OFFSET) {
pr_debug(KBUILD_MODNAME "sanity check failed\n");
return false;
}
/* TCP or UDP ? */
proto = ip_hdr->protocol;
if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) {
pr_debug(KBUILD_MODNAME "protocol not supported\n");
return false;
}
/* Get the source address, source & destination ports, and TCP flags */
addr.s_addr = ip_hdr->saddr;
tcp_hdr = (struct tcphdr*)((u_int32_t *)ip_hdr + ip_hdr->ihl);
/* Yep, it<69>s dirty */
src_port = tcp_hdr->source;
dest_port = tcp_hdr->dest;
if (proto == IPPROTO_TCP) {
tcp_flags = *((u_int8_t*)tcp_hdr + 13);
}
else {
tcp_flags = 0x00;
}
/* We're using IP address 0.0.0.0 for a special purpose here, so don't let
* them spoof us. [DHCP needs this feature - HW] */
if (!addr.s_addr) {
pr_debug(KBUILD_MODNAME "spoofed source address (0.0.0.0)\n");
return false;
}
/* Use jiffies here not to depend on someone setting the time while we're
* running; we need to be careful with possible return value overflows. */
now = jiffies;
spin_lock(&state.lock);
/* Do we know this source address already? */
count = 0;
last = NULL;
if ((curr = *(head = &state.hash[hash = hashfunc(addr)])))
do {
if (curr->src_addr.s_addr == addr.s_addr) break;
count++;
if (curr->next) last = curr;
} while ((curr = curr->next));
if (curr) {
/* We know this address, and the entry isn't too old. Update it. */
if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
time_after_eq(now, curr->timestamp)) {
/* Just update the appropriate list entry if we've seen this port already */
for (index = 0; index < curr->count; index++) {
if (curr->ports[index].number == dest_port) {
curr->ports[index].proto = proto;
curr->ports[index].and_flags &= tcp_flags;
curr->ports[index].or_flags |= tcp_flags;
goto out_no_match;
}
}
/* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */
if (proto == IPPROTO_TCP && (tcp_hdr->ack || tcp_hdr->rst))
goto out_no_match;
/* Packet to a new port, and not TCP/ACK: update the timestamp */
curr->timestamp = now;
/* Logged this scan already? Then drop the packet. */
if (curr->weight >= psdinfo->weight_threshold)
goto out_match;
/* Specify if destination address, source port, TOS or TTL are not fixed */
if (curr->dest_addr.s_addr != ip_hdr->daddr)
curr->flags |= HF_DADDR_CHANGING;
if (curr->src_port != src_port)
curr->flags |= HF_SPORT_CHANGING;
if (curr->tos != ip_hdr->tos)
curr->flags |= HF_TOS_CHANGING;
if (curr->ttl != ip_hdr->ttl)
curr->flags |= HF_TTL_CHANGING;
/* Update the total weight */
curr->weight += (ntohs(dest_port) < 1024) ?
psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
/* Got enough destination ports to decide that this is a scan? */
/* Then log it and drop the packet. */
if (curr->weight >= psdinfo->weight_threshold)
goto out_match;
/* Remember the new port */
if (curr->count < SCAN_MAX_COUNT) {
curr->ports[curr->count].number = dest_port;
curr->ports[curr->count].proto = proto;
curr->ports[curr->count].and_flags = tcp_flags;
curr->ports[curr->count].or_flags = tcp_flags;
curr->count++;
}
goto out_no_match;
}
/* We know this address, but the entry is outdated. Mark it unused, and
* remove from the hash table. We'll allocate a new entry instead since
* this one might get re-used too soon. */
curr->src_addr.s_addr = 0;
if (last)
last->next = last->next->next;
else if (*head)
*head = (*head)->next;
last = NULL;
}
/* We don't need an ACK from a new source address */
if (proto == IPPROTO_TCP && tcp_hdr->ack)
goto out_no_match;
/* Got too many source addresses with the same hash value? Then remove the
* oldest one from the hash table, so that they can't take too much of our
* CPU time even with carefully chosen spoofed IP addresses. */
if (count >= HASH_MAX && last) last->next = NULL;
/* We're going to re-use the oldest list entry, so remove it from the hash
* table first (if it is really already in use, and isn't removed from the
* hash table already because of the HASH_MAX check above). */
/* First, find it */
if (state.list[state.index].src_addr.s_addr)
head = &state.hash[hashfunc(state.list[state.index].src_addr)];
else
head = &last;
last = NULL;
if ((curr = *head))
do {
if (curr == &state.list[state.index]) break;
last = curr;
} while ((curr = curr->next));
/* Then, remove it */
if (curr) {
if (last)
last->next = last->next->next;
else if (*head)
*head = (*head)->next;
}
/* Get our list entry */
curr = &state.list[state.index++];
if (state.index >= LIST_SIZE) state.index = 0;
/* Link it into the hash table */
head = &state.hash[hash];
curr->next = *head;
*head = curr;
/* And fill in the fields */
curr->timestamp = now;
curr->src_addr = addr;
curr->dest_addr.s_addr = ip_hdr->daddr;
curr->src_port = src_port;
curr->count = 1;
curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
curr->ports[0].number = dest_port;
curr->ports[0].proto = proto;
curr->ports[0].and_flags = tcp_flags;
curr->ports[0].or_flags = tcp_flags;
curr->tos = ip_hdr->tos;
curr->ttl = ip_hdr->ttl;
out_no_match:
spin_unlock(&state.lock);
return false;
out_match:
spin_unlock(&state.lock);
return true;
}
static bool xt_psd_checkentry(const struct xt_mtchk_param *par) {
return true;
}
static struct xt_match xt_psd_reg = {
.name = "psd",
.family = AF_INET,
.revision = 9,
.match = xt_psd_match,
.matchsize = sizeof(struct xt_psd_info),
.checkentry = xt_psd_checkentry,
.me = THIS_MODULE
};
static int __init xt_psd_init(void)
{
if(xt_register_match(&xt_psd_reg)) {
memset(&state, 0, sizeof(state));
}
spin_lock_init(&(state.lock));
return 0;
}
static void __exit xt_psd_exit(void)
{
xt_unregister_match(&xt_psd_reg);
}
module_init(xt_psd_init);
module_exit(xt_psd_exit);

41
extensions/xt_psd.h Normal file
View File

@@ -0,0 +1,41 @@
#ifndef _LINUX_NETFILTER_XT_PSD_H
#define _LINUX_NETFILTER_XT_PSD_H 1
#include <linux/param.h>
#include <linux/types.h>
/*
* High port numbers have a lower weight to reduce the frequency of false
* positives, such as from passive mode FTP transfers.
*/
#define PORT_WEIGHT_PRIV 3
#define PORT_WEIGHT_HIGH 1
#define PSD_MAX_RATE 10000
/*
* Port scan detection thresholds: at least COUNT ports need to be scanned
* from the same source, with no longer than DELAY ticks between ports.
*/
#define SCAN_MIN_COUNT 7
#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
#define SCAN_DELAY_THRESHOLD (300) /* old usage of HZ here was erroneously and broke under uml */
/*
* Keep track of up to LIST_SIZE source addresses, using a hash table of
* HASH_SIZE entries for faster lookups, but limiting hash collisions to
* HASH_MAX source addresses per the same hash value.
*/
#define LIST_SIZE 0x100
#define HASH_LOG 9
#define HASH_SIZE (1 << HASH_LOG)
#define HASH_MAX 0x10
struct xt_psd_info {
unsigned int weight_threshold;
unsigned int delay_threshold;
unsigned short lo_ports_weight;
unsigned short hi_ports_weight;
};
#endif /*_LINUX_NETFILTER_XT_PSD_H*/

2
mconfig.psd Normal file
View File

@@ -0,0 +1,2 @@
# -*- Makefile -*-
build_psd=m