diff --git a/doc/README.psd b/doc/README.psd new file mode 100644 index 0000000..4612a7e --- /dev/null +++ b/doc/README.psd @@ -0,0 +1,4 @@ +PSD (Portscan Detection) External extensions for Xtables-addons + +Example: +iptables -A INPUT -m psd --psd-weight-threshold 21 --psd-delay-threshold 300 --psd-lo-ports-weight 1 --psd-hi-ports-weight 10 -j LOG --log-prefix "PSD: " diff --git a/extensions/Kbuild b/extensions/Kbuild index 20d43a8..8a2095d 100644 --- a/extensions/Kbuild +++ b/extensions/Kbuild @@ -26,6 +26,7 @@ obj-${build_ipset} += ipset/ obj-${build_ipv4options} += xt_ipv4options.o obj-${build_length2} += xt_length2.o obj-${build_lscan} += xt_lscan.o +obj-${build_psd} += xt_psd.o obj-${build_quota2} += xt_quota2.o -include ${M}/*.Kbuild diff --git a/extensions/Mbuild b/extensions/Mbuild index ace420b..21aed33 100644 --- a/extensions/Mbuild +++ b/extensions/Mbuild @@ -19,4 +19,5 @@ obj-${build_ipset} += ipset/ obj-${build_ipv4options} += libxt_ipv4options.so obj-${build_length2} += libxt_length2.so obj-${build_lscan} += libxt_lscan.so +obj-${build_psd} += libxt_psd.so obj-${build_quota2} += libxt_quota2.so diff --git a/extensions/libxt_psd.c b/extensions/libxt_psd.c new file mode 100644 index 0000000..88510d0 --- /dev/null +++ b/extensions/libxt_psd.c @@ -0,0 +1,158 @@ +/* + Shared library add-on to iptables to add PSD support + + Copyright (C) 2000,2001 astaro AG + + This file is distributed under the terms of the GNU General Public + License (GPL). Copies of the GPL can be obtained from: + ftp://prep.ai.mit.edu/pub/gnu/GPL + + 2000-05-04 Markus Hennig : initial + 2000-08-18 Dennis Koslowski : first release + 2000-12-01 Dennis Koslowski : UDP scans detection added + 2001-02-04 Jan Rekorajski : converted from target to match + 2003-03-02 Harald Welte : fix 'storage' bug + 2008-04-03 Mohd Nawawi : update to 2.6.24 / 1.4 code + 2008-06-24 Mohd Nawawi : update to 2.6.24 / 1.4.1 code + 2009-08-07 Mohd Nawawi Mohamad Jamili : ported to xtables-addons +*/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "xt_psd.h" + +/* Function which prints out usage message. */ +static void psd_mt_help(void) { + printf( + "psd match options:\n" + " --psd-weight-threshold threshhold Portscan detection weight threshold\n" + " --psd-delay-threshold delay Portscan detection delay threshold\n" + " --psd-lo-ports-weight lo Privileged ports weight\n" + " --psd-hi-ports-weight hi High ports weight\n\n"); +} + +static const struct option psd_mt_opts[] = { + {.name = "psd-weight-threshold", .has_arg = true, .val = '1'}, + {.name = "psd-delay-threshold", .has_arg = true, .val = '2'}, + {.name = "psd-lo-ports-weight", .has_arg = true, .val = '3'}, + {.name = "psd-hi-ports-weight", .has_arg = true, .val = '4'}, + {NULL} +}; + +/* Initialize the target. */ +static void psd_mt_init(struct xt_entry_match *match) { + struct xt_psd_info *psdinfo = (struct xt_psd_info *)match->data; + psdinfo->weight_threshold = SCAN_WEIGHT_THRESHOLD; + psdinfo->delay_threshold = SCAN_DELAY_THRESHOLD; + psdinfo->lo_ports_weight = PORT_WEIGHT_PRIV; + psdinfo->hi_ports_weight = PORT_WEIGHT_HIGH; +} + +#define XT_PSD_OPT_CTRESH 0x01 +#define XT_PSD_OPT_DTRESH 0x02 +#define XT_PSD_OPT_LPWEIGHT 0x04 +#define XT_PSD_OPT_HPWEIGHT 0x08 + +static int psd_mt_parse(int c, char **argv, int invert, unsigned int *flags, + const void *entry, struct xt_entry_match **match) +{ + struct xt_psd_info *psdinfo = (struct xt_psd_info *)(*match)->data; + unsigned int num; + + switch (c) { + /* PSD-weight-threshold */ + case '1': + if (*flags & XT_PSD_OPT_CTRESH) + xtables_error(PARAMETER_PROBLEM,"Can't specify --psd-weight-threshold twice"); + if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) + xtables_error(PARAMETER_PROBLEM, "bad --psd-weight-threshold '%s'", optarg); + psdinfo->weight_threshold = num; + *flags |= XT_PSD_OPT_CTRESH; + return true; + + /* PSD-delay-threshold */ + case '2': + if (*flags & XT_PSD_OPT_DTRESH) + xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-delay-threshold twice"); + if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) + xtables_error(PARAMETER_PROBLEM, "bad --psd-delay-threshold '%s'", optarg); + psdinfo->delay_threshold = num; + *flags |= XT_PSD_OPT_DTRESH; + return true; + + /* PSD-lo-ports-weight */ + case '3': + if (*flags & XT_PSD_OPT_LPWEIGHT) + xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-lo-ports-weight twice"); + if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) + xtables_error(PARAMETER_PROBLEM, "bad --psd-lo-ports-weight '%s'", optarg); + psdinfo->lo_ports_weight = num; + *flags |= XT_PSD_OPT_LPWEIGHT; + return true; + + /* PSD-hi-ports-weight */ + case '4': + if (*flags & XT_PSD_OPT_HPWEIGHT) + xtables_error(PARAMETER_PROBLEM, "Can't specify --psd-hi-ports-weight twice"); + if (!xtables_strtoui(optarg, NULL, &num, 0, PSD_MAX_RATE)) + xtables_error(PARAMETER_PROBLEM, "bad --psd-hi-ports-weight '%s'", optarg); + psdinfo->hi_ports_weight = num; + *flags |= XT_PSD_OPT_HPWEIGHT; + return true; + } + return false; +} + +/* Final check; nothing. */ +static void psd_mt_final_check(unsigned int flags) {} + +/* Prints out the targinfo. */ +static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int numeric) +{ + const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data; + printf("psd "); + printf("weight-threshold: %u ", psdinfo->weight_threshold); + printf("delay-threshold: %u ", psdinfo->delay_threshold); + printf("lo-ports-weight: %u ", psdinfo->lo_ports_weight); + printf("hi-ports-weight: %u ", psdinfo->hi_ports_weight); +} + +/* Saves the union ipt_targinfo in parsable form to stdout. */ +static void psd_mt_save(const void *ip, const struct xt_entry_match *match) +{ + const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data; + printf("--psd-weight-threshold %u ", psdinfo->weight_threshold); + printf("--psd-delay-threshold %u ", psdinfo->delay_threshold); + printf("--psd-lo-ports-weight %u ", psdinfo->lo_ports_weight); + printf("--psd-hi-ports-weight %u ", psdinfo->hi_ports_weight); +} + +static struct xtables_match psd_mt_reg = { + .name = "psd", + .version = XTABLES_VERSION, + .revision = 1, + .family = PF_INET, + .size = XT_ALIGN(sizeof(struct xt_psd_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_psd_info)), + .help = psd_mt_help, + .init = psd_mt_init, + .parse = psd_mt_parse, + .final_check = psd_mt_final_check, + .print = psd_mt_print, + .save = psd_mt_save, + .extra_opts = psd_mt_opts, +}; + +static __attribute__((constructor)) void psd_mt_ldr(void) +{ + xtables_register_match(&psd_mt_reg); +} + diff --git a/extensions/libxt_psd.man b/extensions/libxt_psd.man new file mode 100644 index 0000000..b73fffc --- /dev/null +++ b/extensions/libxt_psd.man @@ -0,0 +1,18 @@ +Attempt to detect TCP and UDP port scans. This match was derived from +Solar Designer's scanlogd. +.TP +.BI "--psd-weight-threshold " "threshold" +Total weight of the latest TCP/UDP packets with different +destination ports coming from the same host to be treated as port +scan sequence. +.TP +.BI "--psd-delay-threshold " "delay" +Delay (in hundredths of second) for the packets with different +destination ports coming from the same host to be treated as +possible port scan subsequence. +.TP +.BI "--psd-lo-ports-weight " "weight" +Weight of the packet with privileged (<=1024) destination port. +.TP +.BI "--psd-hi-ports-weight " "weight" +Weight of the packet with non-priviliged destination port. diff --git a/extensions/xt_psd.Kconfig b/extensions/xt_psd.Kconfig new file mode 100644 index 0000000..d6254a5 --- /dev/null +++ b/extensions/xt_psd.Kconfig @@ -0,0 +1,6 @@ +config NETFILTER_XT_MATCH_PSD + tristate 'psd match support' + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED + ---help--- + This option adds a `psd' match, which allows you to create rules in + any iptables table wich will detect TCP and UDP port scans. diff --git a/extensions/xt_psd.c b/extensions/xt_psd.c new file mode 100644 index 0000000..f12e5cf --- /dev/null +++ b/extensions/xt_psd.c @@ -0,0 +1,332 @@ +/* + This is a module which is used for PSD (portscan detection) + Derived from scanlogd v2.1 written by Solar Designer + and LOG target module. + + Copyright (C) 2000,2001 astaro AG + + This file is distributed under the terms of the GNU General Public + License (GPL). Copies of the GPL can be obtained from: + ftp://prep.ai.mit.edu/pub/gnu/GPL + + 2000-05-04 Markus Hennig : initial + 2000-08-18 Dennis Koslowski : first release + 2000-12-01 Dennis Koslowski : UDP scans detection added + 2001-01-02 Dennis Koslowski : output modified + 2001-02-04 Jan Rekorajski : converted from target to match + 2004-05-05 Martijn Lievaart : ported to 2.6 + 2007-04-05 Mohd Nawawi Mohamad Jamili : ported to 2.6.18 + 2008-03-21 Mohd Nawawi Mohamad Jamili : ported to 2.6.24 + 2009-08-07 Mohd Nawawi Mohamad Jamili : ported to xtables-addons +*/ + +#define pr_fmt(x) KBUILD_MODNAME ": " x +#include +#include +#include +#include +#include +#include +#include +#include +#include "xt_psd.h" +#include "compat_xtables.h" + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Dennis Koslowski "); +MODULE_AUTHOR("Martijn Lievaart "); +MODULE_AUTHOR("Jan Rekorajski "); +MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili "); +MODULE_DESCRIPTION("Xtables: PSD - portscan detection"); +MODULE_ALIAS("ipt_psd"); + +#define HF_DADDR_CHANGING 0x01 +#define HF_SPORT_CHANGING 0x02 +#define HF_TOS_CHANGING 0x04 +#define HF_TTL_CHANGING 0x08 + +/* + * Information we keep per each target port + */ +struct port { + u_int16_t number; /* port number */ + u_int8_t proto; /* protocol number */ + u_int8_t and_flags; /* tcp ANDed flags */ + u_int8_t or_flags; /* tcp ORed flags */ +}; + +/* + * Information we keep per each source address. + */ +struct host { + struct host *next; /* Next entry with the same hash */ + unsigned long timestamp; /* Last update time */ + struct in_addr src_addr; /* Source address */ + struct in_addr dest_addr; /* Destination address */ + unsigned short src_port; /* Source port */ + int count; /* Number of ports in the list */ + int weight; /* Total weight of ports in the list */ + struct port ports[SCAN_MAX_COUNT - 1]; /* List of ports */ + unsigned char tos; /* TOS */ + unsigned char ttl; /* TTL */ + unsigned char flags; /* HF_ flags bitmask */ +}; + +/* + * State information. + */ +static struct { + spinlock_t lock; + struct host list[LIST_SIZE]; /* List of source addresses */ + struct host *hash[HASH_SIZE]; /* Hash: pointers into the list */ + int index; /* Oldest entry to be replaced */ +} state; + +/* + * Convert an IP address into a hash table index. + */ +static inline int hashfunc(struct in_addr addr) +{ + unsigned int value; + int hash; + + value = addr.s_addr; + hash = 0; + do { + hash ^= value; + } while ((value >>= HASH_LOG) != 0); + + return hash & (HASH_SIZE - 1); +} + +static bool +xt_psd_match(const struct sk_buff *pskb, const struct xt_match_param *match) +{ + struct iphdr *iph; + struct tcphdr *tcph; + struct in_addr addr; + u_int16_t src_port,dest_port; + u_int8_t tcp_flags, proto; + unsigned long now; + struct host *curr, *last, **head; + int hash, index, count; + /* Parameters from userspace */ + const struct xt_psd_info *psdinfo = match->matchinfo; + + /* IP header */ + iph = ip_hdr(pskb); + + /* Sanity check */ + if (ntohs(iph->frag_off) & IP_OFFSET) { + pr_debug("sanity check failed\n"); + return false; + } + + /* TCP or UDP ? */ + proto = iph->protocol; + + if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) { + pr_debug("protocol not supported\n"); + return false; + } + + /* Get the source address, source & destination ports, and TCP flags */ + + addr.s_addr = iph->saddr; + + tcph = (void *)iph + ip_hdrlen(pskb); + + /* Yep, it's dirty */ + src_port = tcph->source; + dest_port = tcph->dest; + + if (proto == IPPROTO_TCP) + tcp_flags = *((u_int8_t*)tcph + 13); + else + tcp_flags = 0x00; + + /* We're using IP address 0.0.0.0 for a special purpose here, so don't let + * them spoof us. [DHCP needs this feature - HW] */ + if (addr.s_addr == 0) { + pr_debug("spoofed source address (0.0.0.0)\n"); + return false; + } + + /* Use jiffies here not to depend on someone setting the time while we're + * running; we need to be careful with possible return value overflows. */ + now = jiffies; + + spin_lock(&state.lock); + + /* Do we know this source address already? */ + count = 0; + last = NULL; + if ((curr = *(head = &state.hash[hash = hashfunc(addr)])) != NULL) + do { + if (curr->src_addr.s_addr == addr.s_addr) + break; + count++; + if (curr->next != NULL) + last = curr; + } while ((curr = curr->next) != NULL); + + if (curr != NULL) { + + /* We know this address, and the entry isn't too old. Update it. */ + if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 && + time_after_eq(now, curr->timestamp)) { + + /* Just update the appropriate list entry if we've seen this port already */ + for (index = 0; index < curr->count; index++) { + if (curr->ports[index].number == dest_port) { + curr->ports[index].proto = proto; + curr->ports[index].and_flags &= tcp_flags; + curr->ports[index].or_flags |= tcp_flags; + goto out_no_match; + } + } + + /* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */ + if (proto == IPPROTO_TCP && (tcph->ack || tcph->rst)) + goto out_no_match; + + /* Packet to a new port, and not TCP/ACK: update the timestamp */ + curr->timestamp = now; + + /* Logged this scan already? Then drop the packet. */ + if (curr->weight >= psdinfo->weight_threshold) + goto out_match; + + /* Specify if destination address, source port, TOS or TTL are not fixed */ + if (curr->dest_addr.s_addr != iph->daddr) + curr->flags |= HF_DADDR_CHANGING; + if (curr->src_port != src_port) + curr->flags |= HF_SPORT_CHANGING; + if (curr->tos != iph->tos) + curr->flags |= HF_TOS_CHANGING; + if (curr->ttl != iph->ttl) + curr->flags |= HF_TTL_CHANGING; + + /* Update the total weight */ + curr->weight += (ntohs(dest_port) < 1024) ? + psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; + + /* Got enough destination ports to decide that this is a scan? */ + /* Then log it and drop the packet. */ + if (curr->weight >= psdinfo->weight_threshold) + goto out_match; + + /* Remember the new port */ + if (curr->count < SCAN_MAX_COUNT) { + curr->ports[curr->count].number = dest_port; + curr->ports[curr->count].proto = proto; + curr->ports[curr->count].and_flags = tcp_flags; + curr->ports[curr->count].or_flags = tcp_flags; + curr->count++; + } + + goto out_no_match; + } + + /* We know this address, but the entry is outdated. Mark it unused, and + * remove from the hash table. We'll allocate a new entry instead since + * this one might get re-used too soon. */ + curr->src_addr.s_addr = 0; + if (last != NULL) + last->next = last->next->next; + else if (*head != NULL) + *head = (*head)->next; + last = NULL; + } + + /* We don't need an ACK from a new source address */ + if (proto == IPPROTO_TCP && tcph->ack) + goto out_no_match; + + /* Got too many source addresses with the same hash value? Then remove the + * oldest one from the hash table, so that they can't take too much of our + * CPU time even with carefully chosen spoofed IP addresses. */ + if (count >= HASH_MAX && last != NULL) + last->next = NULL; + + /* We're going to re-use the oldest list entry, so remove it from the hash + * table first (if it is really already in use, and isn't removed from the + * hash table already because of the HASH_MAX check above). */ + + /* First, find it */ + if (state.list[state.index].src_addr.s_addr != 0) + head = &state.hash[hashfunc(state.list[state.index].src_addr)]; + else + head = &last; + last = NULL; + if ((curr = *head) != NULL) + do { + if (curr == &state.list[state.index]) + break; + last = curr; + } while ((curr = curr->next) != NULL); + + /* Then, remove it */ + if (curr != NULL) { + if (last != NULL) + last->next = last->next->next; + else if (*head != NULL) + *head = (*head)->next; + } + + /* Get our list entry */ + curr = &state.list[state.index++]; + if (state.index >= LIST_SIZE) + state.index = 0; + + /* Link it into the hash table */ + head = &state.hash[hash]; + curr->next = *head; + *head = curr; + + /* And fill in the fields */ + curr->timestamp = now; + curr->src_addr = addr; + curr->dest_addr.s_addr = iph->daddr; + curr->src_port = src_port; + curr->count = 1; + curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight; + curr->ports[0].number = dest_port; + curr->ports[0].proto = proto; + curr->ports[0].and_flags = tcp_flags; + curr->ports[0].or_flags = tcp_flags; + curr->tos = iph->tos; + curr->ttl = iph->ttl; + +out_no_match: + spin_unlock(&state.lock); + return false; + +out_match: + spin_unlock(&state.lock); + return true; +} + +static struct xt_match xt_psd_reg __read_mostly = { + .name = "psd", + .family = AF_INET, + .revision = 1, + .match = xt_psd_match, + .matchsize = sizeof(struct xt_psd_info), + .me = THIS_MODULE, +}; + +static int __init xt_psd_init(void) +{ + spin_lock_init(&(state.lock)); + return xt_register_match(&xt_psd_reg); +} + +static void __exit xt_psd_exit(void) +{ + xt_unregister_match(&xt_psd_reg); +} + +module_init(xt_psd_init); +module_exit(xt_psd_exit); + diff --git a/extensions/xt_psd.h b/extensions/xt_psd.h new file mode 100644 index 0000000..ac65687 --- /dev/null +++ b/extensions/xt_psd.h @@ -0,0 +1,41 @@ +#ifndef _LINUX_NETFILTER_XT_PSD_H +#define _LINUX_NETFILTER_XT_PSD_H 1 + +#include +#include + +/* + * High port numbers have a lower weight to reduce the frequency of false + * positives, such as from passive mode FTP transfers. + */ +#define PORT_WEIGHT_PRIV 3 +#define PORT_WEIGHT_HIGH 1 +#define PSD_MAX_RATE 10000 + +/* + * Port scan detection thresholds: at least COUNT ports need to be scanned + * from the same source, with no longer than DELAY ticks between ports. + */ +#define SCAN_MIN_COUNT 7 +#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV) +#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT +#define SCAN_DELAY_THRESHOLD (300) /* old usage of HZ here was erroneously and broke under uml */ + +/* + * Keep track of up to LIST_SIZE source addresses, using a hash table of + * HASH_SIZE entries for faster lookups, but limiting hash collisions to + * HASH_MAX source addresses per the same hash value. + */ +#define LIST_SIZE 0x100 +#define HASH_LOG 9 +#define HASH_SIZE (1 << HASH_LOG) +#define HASH_MAX 0x10 + +struct xt_psd_info { + __u32 weight_threshold; + __u32 delay_threshold; + __u16 lo_ports_weight; + __u16 hi_ports_weight; +}; + +#endif /*_LINUX_NETFILTER_XT_PSD_H*/ diff --git a/mconfig b/mconfig index b295e8c..cbeaa69 100644 --- a/mconfig +++ b/mconfig @@ -21,4 +21,5 @@ build_ipset=m build_ipv4options=m build_length2=m build_lscan=m +build_psd=m build_quota2=m