mirror of
git://git.code.sf.net/p/xtables-addons/xtables-addons
synced 2025-09-06 20:55:13 +02:00
TARPIT: add IPv6 support
This adds IPv6 support for the tarpit target. It performs the same functionality as the v4 version, but with IPv6 connections. Signed-off-by: Josh Hunt <johunt@akamai.com>
This commit is contained in:
Josh Hunt
committed by
Jan Engelhardt
Jan Engelhardt
parent
4eb97c7a01
commit
7cd01e0b14
@@ -42,10 +42,15 @@
|
||||
#include <linux/module.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/version.h>
|
||||
#include <linux/netfilter_ipv6.h>
|
||||
#include <linux/netfilter/x_tables.h>
|
||||
#ifdef CONFIG_BRIDGE_NETFILTER
|
||||
# include <linux/netfilter_bridge.h>
|
||||
#endif
|
||||
#include <net/addrconf.h>
|
||||
#include <net/ip6_checksum.h>
|
||||
#include <net/ip6_route.h>
|
||||
#include <net/ipv6.h>
|
||||
#include <net/route.h>
|
||||
#include <net/tcp.h>
|
||||
#include "compat_xtables.h"
|
||||
@@ -162,7 +167,7 @@ static bool tarpit_generic(struct tcphdr *tcph, const struct tcphdr *oth,
|
||||
return true;
|
||||
}
|
||||
|
||||
static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook,
|
||||
static void tarpit_tcp4(struct sk_buff *oldskb, unsigned int hook,
|
||||
unsigned int mode)
|
||||
{
|
||||
struct tcphdr _otcph, *tcph;
|
||||
@@ -293,8 +298,130 @@ static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook,
|
||||
kfree_skb(nskb);
|
||||
}
|
||||
|
||||
static void tarpit_tcp6(struct sk_buff *oldskb, unsigned int hook,
|
||||
unsigned int mode)
|
||||
{
|
||||
struct sk_buff *nskb;
|
||||
struct tcphdr *tcph, oth;
|
||||
unsigned int otcplen;
|
||||
int tcphoff;
|
||||
const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
|
||||
struct ipv6hdr *ip6h;
|
||||
const uint8_t tclass = 0;
|
||||
uint8_t proto;
|
||||
uint16_t payload;
|
||||
|
||||
proto = oip6h->nexthdr;
|
||||
tcphoff = ipv6_skip_exthdr(oldskb,
|
||||
(uint8_t *)(oip6h + 1) - oldskb->data, &proto);
|
||||
|
||||
if (tcphoff < 0 || tcphoff > oldskb->len) {
|
||||
pr_debug("Cannot get TCP header.\n");
|
||||
return;
|
||||
}
|
||||
|
||||
otcplen = oldskb->len - tcphoff;
|
||||
|
||||
/* IP header checks: fragment, too short. */
|
||||
if (proto != IPPROTO_TCP || otcplen < sizeof(struct tcphdr)) {
|
||||
pr_debug("proto(%d) != IPPROTO_TCP, "
|
||||
"or too short. otcplen = %d\n",
|
||||
proto, otcplen);
|
||||
return;
|
||||
}
|
||||
|
||||
if (skb_copy_bits(oldskb, tcphoff, &oth, sizeof(struct tcphdr))) {
|
||||
WARN_ON(1);
|
||||
return;
|
||||
}
|
||||
|
||||
/* Check checksum. */
|
||||
if (csum_ipv6_magic(&oip6h->saddr, &oip6h->daddr, otcplen, IPPROTO_TCP,
|
||||
skb_checksum(oldskb, tcphoff, otcplen, 0))) {
|
||||
pr_debug("TCP checksum is invalid\n");
|
||||
return;
|
||||
}
|
||||
|
||||
nskb = skb_copy_expand(oldskb, LL_MAX_HEADER,
|
||||
skb_tailroom(oldskb), GFP_ATOMIC);
|
||||
if (nskb == NULL) {
|
||||
if (net_ratelimit())
|
||||
pr_debug("cannot alloc skb\n");
|
||||
return;
|
||||
}
|
||||
|
||||
/* This packet will not be the same as the other: clear nf fields */
|
||||
nf_reset(nskb);
|
||||
skb_nfmark(nskb) = 0;
|
||||
skb_init_secmark(nskb);
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
|
||||
skb_shinfo(nskb)->gso_size = 0;
|
||||
skb_shinfo(nskb)->gso_segs = 0;
|
||||
skb_shinfo(nskb)->gso_type = 0;
|
||||
#endif
|
||||
|
||||
skb_put(nskb, sizeof(struct ipv6hdr));
|
||||
ip6h = ipv6_hdr(nskb);
|
||||
*(__be32 *)ip6h = htonl(0x60000000 | (tclass << 20));
|
||||
ip6h->nexthdr = IPPROTO_TCP;
|
||||
ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);
|
||||
ipv6_addr_copy(&ip6h->daddr, &oip6h->saddr);
|
||||
|
||||
/* Adjust IP TTL */
|
||||
if (mode == XTTARPIT_HONEYPOT)
|
||||
ip6h->hop_limit = 128;
|
||||
else
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26)
|
||||
ip6h->hop_limit = ip6_dst_hoplimit(skb_dst(nskb));
|
||||
#else
|
||||
ip6h->hop_limit = dst_metric(dst, RTAX_HOPLIMIT);
|
||||
if (ip6h->hop_limit < 0)
|
||||
ip6h->hop_limit = ipv6_get_hoplimit((skb_dst(nskb))->dev).
|
||||
#endif
|
||||
|
||||
tcph = (struct tcphdr *)(skb_network_header(nskb) +
|
||||
sizeof(struct ipv6hdr));
|
||||
|
||||
/* Truncate to length (no data) */
|
||||
skb_trim(nskb, sizeof(struct ipv6hdr) + sizeof(struct tcphdr));
|
||||
tcph->doff = sizeof(struct tcphdr)/4;
|
||||
tcph->source = oth.dest;
|
||||
tcph->dest = oth.source;
|
||||
tcph->urg_ptr = 0;
|
||||
/* Reset flags */
|
||||
((uint8_t *)tcph)[13] = 0;
|
||||
|
||||
payload = nskb->len - sizeof(struct ipv6hdr) - sizeof(struct tcphdr);
|
||||
if (!tarpit_generic(&oth, tcph, payload, mode))
|
||||
return;
|
||||
|
||||
ip6h->payload_len = htons(sizeof(struct tcphdr));
|
||||
tcph->check = 0;
|
||||
|
||||
/* Adjust TCP checksum */
|
||||
tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr,
|
||||
&ipv6_hdr(nskb)->daddr, sizeof(struct tcphdr),
|
||||
IPPROTO_TCP,
|
||||
csum_partial(tcph, sizeof(struct tcphdr), 0));
|
||||
|
||||
if (ip6_route_me_harder(nskb))
|
||||
goto free_nskb;
|
||||
|
||||
nskb->ip_summed = CHECKSUM_NONE;
|
||||
|
||||
nf_ct_attach(nskb, oldskb);
|
||||
|
||||
NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, nskb, NULL,
|
||||
skb_dst(nskb)->dev, dst_output);
|
||||
return;
|
||||
|
||||
free_nskb:
|
||||
kfree_skb(nskb);
|
||||
}
|
||||
|
||||
static unsigned int
|
||||
tarpit_tg(struct sk_buff **pskb, const struct xt_action_param *par)
|
||||
tarpit_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
|
||||
{
|
||||
const struct sk_buff *skb = *pskb;
|
||||
const struct iphdr *iph = ip_hdr(skb);
|
||||
@@ -325,29 +452,82 @@ tarpit_tg(struct sk_buff **pskb, const struct xt_action_param *par)
|
||||
if (iph->frag_off & htons(IP_OFFSET))
|
||||
return NF_DROP;
|
||||
|
||||
tarpit_tcp(*pskb, par->hooknum, info->variant);
|
||||
tarpit_tcp4(*pskb, par->hooknum, info->variant);
|
||||
return NF_DROP;
|
||||
}
|
||||
|
||||
static struct xt_target tarpit_tg_reg __read_mostly = {
|
||||
.name = "TARPIT",
|
||||
.revision = 0,
|
||||
.family = NFPROTO_IPV4,
|
||||
.hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
|
||||
.proto = IPPROTO_TCP,
|
||||
.target = tarpit_tg,
|
||||
.targetsize = sizeof(struct xt_tarpit_tginfo),
|
||||
.me = THIS_MODULE,
|
||||
static unsigned int
|
||||
tarpit_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
|
||||
{
|
||||
const struct sk_buff *skb = *pskb;
|
||||
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
||||
const struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
|
||||
const struct xt_tarpit_tginfo *info = par->targinfo;
|
||||
uint8_t proto;
|
||||
|
||||
/* Do we have an input route cache entry? (Not in PREROUTING.) */
|
||||
if (rt == NULL) {
|
||||
pr_debug("Dropping no input route cache entry\n");
|
||||
return NF_DROP;
|
||||
}
|
||||
|
||||
/* No replies to physical multicast/broadcast */
|
||||
/* skb != PACKET_OTHERHOST handled by ip_rcv() */
|
||||
if (skb->pkt_type != PACKET_HOST) {
|
||||
pr_debug("type != PACKET_HOST");
|
||||
return NF_DROP;
|
||||
}
|
||||
|
||||
/*
|
||||
* Our naive response construction does not deal with IP
|
||||
* options, and probably should not try.
|
||||
*/
|
||||
proto = iph->nexthdr;
|
||||
if (ipv6_skip_exthdr(skb, skb_network_header_len(skb), &proto) !=
|
||||
sizeof(struct ipv6hdr))
|
||||
return NF_DROP;
|
||||
|
||||
if ((!(ipv6_addr_type(&iph->saddr) & IPV6_ADDR_UNICAST)) ||
|
||||
(!(ipv6_addr_type(&iph->daddr) & IPV6_ADDR_UNICAST))) {
|
||||
pr_debug("addr is not unicast.\n");
|
||||
return NF_DROP;
|
||||
}
|
||||
|
||||
tarpit_tcp6(*pskb, par->hooknum, info->variant);
|
||||
return NF_DROP;
|
||||
}
|
||||
|
||||
static struct xt_target tarpit_tg_reg[] __read_mostly = {
|
||||
{
|
||||
.name = "TARPIT",
|
||||
.revision = 0,
|
||||
.family = NFPROTO_IPV4,
|
||||
.hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
|
||||
.proto = IPPROTO_TCP,
|
||||
.target = tarpit_tg4,
|
||||
.targetsize = sizeof(struct xt_tarpit_tginfo),
|
||||
.me = THIS_MODULE,
|
||||
},
|
||||
{
|
||||
.name = "TARPIT",
|
||||
.revision = 0,
|
||||
.family = NFPROTO_IPV6,
|
||||
.hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
|
||||
.proto = IPPROTO_TCP,
|
||||
.target = tarpit_tg6,
|
||||
.targetsize = sizeof(struct xt_tarpit_tginfo),
|
||||
.me = THIS_MODULE,
|
||||
},
|
||||
};
|
||||
|
||||
static int __init tarpit_tg_init(void)
|
||||
{
|
||||
return xt_register_target(&tarpit_tg_reg);
|
||||
return xt_register_targets(tarpit_tg_reg, ARRAY_SIZE(tarpit_tg_reg));
|
||||
}
|
||||
|
||||
static void __exit tarpit_tg_exit(void)
|
||||
{
|
||||
xt_unregister_target(&tarpit_tg_reg);
|
||||
xt_unregister_targets(tarpit_tg_reg, ARRAY_SIZE(tarpit_tg_reg));
|
||||
}
|
||||
|
||||
module_init(tarpit_tg_init);
|
||||
@@ -356,3 +536,4 @@ MODULE_DESCRIPTION("Xtables: \"TARPIT\", capture and hold TCP connections");
|
||||
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
|
||||
MODULE_LICENSE("GPL");
|
||||
MODULE_ALIAS("ipt_TARPIT");
|
||||
MODULE_ALIAS("ip6t_TARPIT");
|
||||
|
||||
Reference in New Issue
Block a user