pom-ng-psd-20060504.patch

   1  include/linux/netfilter_ipv4/ipt_psd.h |   40 +++
   2  net/ipv4/netfilter/Kconfig             |   10
   3  net/ipv4/netfilter/Makefile            |    1
   4  net/ipv4/netfilter/ipt_psd.c           |  358 +++++++++++++++++++++++++++++++++
   5  4 files changed, 409 insertions(+)
   6
   7 diff -Nur --exclude '*.orig' linux.org/include/linux/netfilter_ipv4/ipt_psd.h linux/include/linux/netfilter_ipv4/ipt_psd.h
   8 --- linux.org/include/linux/netfilter_ipv4/ipt_psd.h    1970-01-01 01:00:00.000000000 +0100
   9 +++ linux/include/linux/netfilter_ipv4/ipt_psd.h        2006-05-04 10:21:57.000000000 +0200
  10 @@ -0,0 +1,40 @@
  11 +#ifndef _IPT_PSD_H
  12 +#define _IPT_PSD_H
  13 +
  14 +#include <linux/param.h>
  15 +#include <linux/types.h>
  16 +
  17 +/*
  18 + * High port numbers have a lower weight to reduce the frequency of false
  19 + * positives, such as from passive mode FTP transfers.
  20 + */
  21 +#define PORT_WEIGHT_PRIV               3
  22 +#define PORT_WEIGHT_HIGH               1
  23 +
  24 +/*
  25 + * Port scan detection thresholds: at least COUNT ports need to be scanned
  26 + * from the same source, with no longer than DELAY ticks between ports.
  27 + */
  28 +#define SCAN_MIN_COUNT                 7
  29 +#define SCAN_MAX_COUNT                 (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
  30 +#define SCAN_WEIGHT_THRESHOLD          SCAN_MAX_COUNT
  31 +#define SCAN_DELAY_THRESHOLD           (300) /* old usage of HZ here was erroneously and broke under uml */
  32 +
  33 +/*
  34 + * Keep track of up to LIST_SIZE source addresses, using a hash table of
  35 + * HASH_SIZE entries for faster lookups, but limiting hash collisions to
  36 + * HASH_MAX source addresses per the same hash value.
  37 + */
  38 +#define LIST_SIZE                      0x100
  39 +#define HASH_LOG                       9
  40 +#define HASH_SIZE                      (1 << HASH_LOG)
  41 +#define HASH_MAX                       0x10
  42 +
  43 +struct ipt_psd_info {
  44 +       unsigned int weight_threshold;
  45 +       unsigned int delay_threshold;
  46 +       unsigned short lo_ports_weight;
  47 +       unsigned short hi_ports_weight;
  48 +};
  49 +
  50 +#endif /*_IPT_PSD_H*/
  51 diff -Nur --exclude '*.orig' linux.org/net/ipv4/netfilter/Kconfig linux/net/ipv4/netfilter/Kconfig
  52 --- linux.org/net/ipv4/netfilter/Kconfig        2006-05-02 23:38:44.000000000 +0200
  53 +++ linux/net/ipv4/netfilter/Kconfig    2006-05-04 10:21:57.000000000 +0200
  54 @@ -606,5 +606,15 @@
  55           Allows altering the ARP packet payload: source and destination
  56           hardware and network addresses.
  57
  58 +config IP_NF_MATCH_PSD
  59 +       tristate  'psd match support'
  60 +       depends on IP_NF_IPTABLES
  61 +       help
  62 +         This option adds a `psd' match, which allows you to create rules in
  63 +         any iptables table wich will detect TCP and UDP port scans.
  64 +
  65 +         If you want to compile it as a module, say M here and read
  66 +         Documentation/modules.txt.  If unsure, say `N'.
  67 +
  68  endmenu
  69
  70 diff -Nur --exclude '*.orig' linux.org/net/ipv4/netfilter/Makefile linux/net/ipv4/netfilter/Makefile
  71 --- linux.org/net/ipv4/netfilter/Makefile       2006-05-02 23:38:44.000000000 +0200
  72 +++ linux/net/ipv4/netfilter/Makefile   2006-05-04 10:21:57.000000000 +0200
  73 @@ -0,0 +0,1 @@
  74 +obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
  75 diff -Nur --exclude '*.orig' linux.org/net/ipv4/netfilter/ipt_psd.c linux/net/ipv4/netfilter/ipt_psd.c
  76 --- linux.org/net/ipv4/netfilter/ipt_psd.c      1970-01-01 01:00:00.000000000 +0100
  77 +++ linux/net/ipv4/netfilter/ipt_psd.c  2006-05-04 10:21:57.000000000 +0200
  78 @@ -0,0 +1,359 @@
  79 +/*
  80 +  This is a module which is used for PSD (portscan detection)
  81 +  Derived from scanlogd v2.1 written by Solar Designer <solar@false.com>
  82 +  and LOG target module.
  83 +
  84 +  Copyright (C) 2000,2001 astaro AG
  85 +
  86 +  This file is distributed under the terms of the GNU General Public
  87 +  License (GPL). Copies of the GPL can be obtained from:
  88 +     ftp://prep.ai.mit.edu/pub/gnu/GPL
  89 +
  90 +  2000-05-04 Markus Hennig <hennig@astaro.de> : initial
  91 +  2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
  92 +  2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
  93 +  2001-01-02 Dennis Koslowski <koslowski@astaro.de> : output modified
  94 +  2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
  95 +  2004-05-05 Martijn Lievaart <m@rtij.nl> : ported to 2.6
  96 +*/
  97 +
  98 +#include <linux/module.h>
  99 +#include <linux/skbuff.h>
 100 +#include <linux/ip.h>
 101 +#include <net/tcp.h>
 102 +#include <linux/spinlock.h>
 103 +#include <linux/netfilter_ipv4/ip_tables.h>
 104 +#include <linux/netfilter_ipv4/ipt_psd.h>
 105 +
 106 +#if 0
 107 +#define DEBUGP printk
 108 +#else
 109 +#define DEBUGP(format, args...)
 110 +#endif
 111 +
 112 +MODULE_LICENSE("GPL");
 113 +MODULE_AUTHOR("Dennis Koslowski <koslowski@astaro.com>");
 114 +
 115 +#define HF_DADDR_CHANGING   0x01
 116 +#define HF_SPORT_CHANGING   0x02
 117 +#define HF_TOS_CHANGING            0x04
 118 +#define HF_TTL_CHANGING            0x08
 119 +
 120 +/*
 121 + * Information we keep per each target port
 122 + */
 123 +struct port {
 124 +       u_int16_t number;      /* port number */
 125 +       u_int8_t proto;        /* protocol number */
 126 +       u_int8_t and_flags;    /* tcp ANDed flags */
 127 +       u_int8_t or_flags;     /* tcp ORed flags */
 128 +};
 129 +
 130 +/*
 131 + * Information we keep per each source address.
 132 + */
 133 +struct host {
 134 +       struct host *next;              /* Next entry with the same hash */
 135 +       clock_t timestamp;              /* Last update time */
 136 +       struct in_addr src_addr;        /* Source address */
 137 +       struct in_addr dest_addr;       /* Destination address */
 138 +       unsigned short src_port;        /* Source port */
 139 +       int count;                      /* Number of ports in the list */
 140 +       int weight;                     /* Total weight of ports in the list */
 141 +       struct port ports[SCAN_MAX_COUNT - 1];  /* List of ports */
 142 +       unsigned char tos;              /* TOS */
 143 +       unsigned char ttl;              /* TTL */
 144 +       unsigned char flags;            /* HF_ flags bitmask */
 145 +};
 146 +
 147 +/*
 148 + * State information.
 149 + */
 150 +static struct {
 151 +       spinlock_t lock;
 152 +       struct host list[LIST_SIZE];    /* List of source addresses */
 153 +       struct host *hash[HASH_SIZE];   /* Hash: pointers into the list */
 154 +       int index;                      /* Oldest entry to be replaced */
 155 +} state;
 156 +
 157 +/*
 158 + * Convert an IP address into a hash table index.
 159 + */
 160 +static inline int hashfunc(struct in_addr addr)
 161 +{
 162 +       unsigned int value;
 163 +       int hash;
 164 +
 165 +       value = addr.s_addr;
 166 +       hash = 0;
 167 +       do {
 168 +               hash ^= value;
 169 +       } while ((value >>= HASH_LOG));
 170 +
 171 +       return hash & (HASH_SIZE - 1);
 172 +}
 173 +
 174 +static int
 175 +ipt_psd_match(const struct sk_buff *pskb,
 176 +             const struct net_device *in,
 177 +             const struct net_device *out,
 178 +             const void *matchinfo,
 179 +             int offset,
 180 +             unsigned int protoff,
 181 +             int *hotdrop)
 182 +{
 183 +       struct iphdr *ip_hdr;
 184 +       struct tcphdr *tcp_hdr;
 185 +       struct in_addr addr;
 186 +       u_int16_t src_port,dest_port;
 187 +       u_int8_t tcp_flags, proto;
 188 +       clock_t now;
 189 +       struct host *curr, *last, **head;
 190 +       int hash, index, count;
 191 +
 192 +       /* Parameters from userspace */
 193 +       const struct ipt_psd_info *psdinfo = matchinfo;
 194 +
 195 +       /* IP header */
 196 +       ip_hdr = pskb->nh.iph;
 197 +
 198 +       /* Sanity check */
 199 +       if (ntohs(ip_hdr->frag_off) & IP_OFFSET) {
 200 +               DEBUGP("PSD: sanity check failed\n");
 201 +               return 0;
 202 +       }
 203 +
 204 +       /* TCP or UDP ? */
 205 +       proto = ip_hdr->protocol;
 206 +
 207 +       if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) {
 208 +               DEBUGP("PSD: protocol not supported\n");
 209 +               return 0;
 210 +       }
 211 +
 212 +       /* Get the source address, source & destination ports, and TCP flags */
 213 +
 214 +       addr.s_addr = ip_hdr->saddr;
 215 +
 216 +       tcp_hdr = (struct tcphdr*)((u_int32_t *)ip_hdr + ip_hdr->ihl);
 217 +
 218 +       /* Yep, it´s dirty */
 219 +       src_port = tcp_hdr->source;
 220 +       dest_port = tcp_hdr->dest;
 221 +
 222 +       if (proto == IPPROTO_TCP) {
 223 +               tcp_flags = *((u_int8_t*)tcp_hdr + 13);
 224 +       }
 225 +       else {
 226 +               tcp_flags = 0x00;
 227 +       }
 228 +
 229 +       /* We're using IP address 0.0.0.0 for a special purpose here, so don't let
 230 +        * them spoof us. [DHCP needs this feature - HW] */
 231 +       if (!addr.s_addr) {
 232 +               DEBUGP("PSD: spoofed source address (0.0.0.0)\n");
 233 +               return 0;
 234 +       }
 235 +
 236 +       /* Use jiffies here not to depend on someone setting the time while we're
 237 +        * running; we need to be careful with possible return value overflows. */
 238 +       now = jiffies;
 239 +
 240 +       spin_lock(&state.lock);
 241 +
 242 +       /* Do we know this source address already? */
 243 +       count = 0;
 244 +       last = NULL;
 245 +       if ((curr = *(head = &state.hash[hash = hashfunc(addr)])))
 246 +               do {
 247 +                       if (curr->src_addr.s_addr == addr.s_addr) break;
 248 +                       count++;
 249 +                       if (curr->next) last = curr;
 250 +               } while ((curr = curr->next));
 251 +
 252 +       if (curr) {
 253 +
 254 +               /* We know this address, and the entry isn't too old. Update it. */
 255 +               if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
 256 +                   time_after_eq(now, curr->timestamp)) {
 257 +
 258 +                       /* Just update the appropriate list entry if we've seen this port already */
 259 +                       for (index = 0; index < curr->count; index++) {
 260 +                               if (curr->ports[index].number == dest_port) {
 261 +                                       curr->ports[index].proto = proto;
 262 +                                       curr->ports[index].and_flags &= tcp_flags;
 263 +                                       curr->ports[index].or_flags |= tcp_flags;
 264 +                                       goto out_no_match;
 265 +                               }
 266 +                       }
 267 +
 268 +                       /* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */
 269 +                       if (proto == IPPROTO_TCP && (tcp_hdr->ack || tcp_hdr->rst))
 270 +                               goto out_no_match;
 271 +
 272 +                       /* Packet to a new port, and not TCP/ACK: update the timestamp */
 273 +                       curr->timestamp = now;
 274 +
 275 +                       /* Logged this scan already? Then drop the packet. */
 276 +                       if (curr->weight >= psdinfo->weight_threshold)
 277 +                               goto out_match;
 278 +
 279 +                       /* Specify if destination address, source port, TOS or TTL are not fixed */
 280 +                       if (curr->dest_addr.s_addr != ip_hdr->daddr)
 281 +                               curr->flags |= HF_DADDR_CHANGING;
 282 +                       if (curr->src_port != src_port)
 283 +                               curr->flags |= HF_SPORT_CHANGING;
 284 +                       if (curr->tos != ip_hdr->tos)
 285 +                               curr->flags |= HF_TOS_CHANGING;
 286 +                       if (curr->ttl != ip_hdr->ttl)
 287 +                               curr->flags |= HF_TTL_CHANGING;
 288 +
 289 +                       /* Update the total weight */
 290 +                       curr->weight += (ntohs(dest_port) < 1024) ?
 291 +                               psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
 292 +
 293 +                       /* Got enough destination ports to decide that this is a scan? */
 294 +                       /* Then log it and drop the packet. */
 295 +                       if (curr->weight >= psdinfo->weight_threshold)
 296 +                               goto out_match;
 297 +
 298 +                       /* Remember the new port */
 299 +                       if (curr->count < SCAN_MAX_COUNT) {
 300 +                               curr->ports[curr->count].number = dest_port;
 301 +                               curr->ports[curr->count].proto = proto;
 302 +                               curr->ports[curr->count].and_flags = tcp_flags;
 303 +                               curr->ports[curr->count].or_flags = tcp_flags;
 304 +                               curr->count++;
 305 +                       }
 306 +
 307 +                       goto out_no_match;
 308 +               }
 309 +
 310 +               /* We know this address, but the entry is outdated. Mark it unused, and
 311 +                * remove from the hash table. We'll allocate a new entry instead since
 312 +                * this one might get re-used too soon. */
 313 +               curr->src_addr.s_addr = 0;
 314 +               if (last)
 315 +                       last->next = last->next->next;
 316 +               else if (*head)
 317 +                       *head = (*head)->next;
 318 +               last = NULL;
 319 +       }
 320 +
 321 +       /* We don't need an ACK from a new source address */
 322 +       if (proto == IPPROTO_TCP && tcp_hdr->ack)
 323 +               goto out_no_match;
 324 +
 325 +       /* Got too many source addresses with the same hash value? Then remove the
 326 +        * oldest one from the hash table, so that they can't take too much of our
 327 +        * CPU time even with carefully chosen spoofed IP addresses. */
 328 +       if (count >= HASH_MAX && last) last->next = NULL;
 329 +
 330 +       /* We're going to re-use the oldest list entry, so remove it from the hash
 331 +        * table first (if it is really already in use, and isn't removed from the
 332 +        * hash table already because of the HASH_MAX check above). */
 333 +
 334 +       /* First, find it */
 335 +       if (state.list[state.index].src_addr.s_addr)
 336 +               head = &state.hash[hashfunc(state.list[state.index].src_addr)];
 337 +       else
 338 +               head = &last;
 339 +       last = NULL;
 340 +       if ((curr = *head))
 341 +       do {
 342 +               if (curr == &state.list[state.index]) break;
 343 +               last = curr;
 344 +       } while ((curr = curr->next));
 345 +
 346 +       /* Then, remove it */
 347 +       if (curr) {
 348 +               if (last)
 349 +                       last->next = last->next->next;
 350 +               else if (*head)
 351 +                       *head = (*head)->next;
 352 +       }
 353 +
 354 +       /* Get our list entry */
 355 +       curr = &state.list[state.index++];
 356 +       if (state.index >= LIST_SIZE) state.index = 0;
 357 +
 358 +       /* Link it into the hash table */
 359 +       head = &state.hash[hash];
 360 +       curr->next = *head;
 361 +       *head = curr;
 362 +
 363 +       /* And fill in the fields */
 364 +       curr->timestamp = now;
 365 +       curr->src_addr = addr;
 366 +       curr->dest_addr.s_addr = ip_hdr->daddr;
 367 +       curr->src_port = src_port;
 368 +       curr->count = 1;
 369 +       curr->weight = (ntohs(dest_port) < 1024) ?
 370 +               psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
 371 +       curr->ports[0].number = dest_port;
 372 +       curr->ports[0].proto = proto;
 373 +       curr->ports[0].and_flags = tcp_flags;
 374 +       curr->ports[0].or_flags = tcp_flags;
 375 +       curr->tos = ip_hdr->tos;
 376 +       curr->ttl = ip_hdr->ttl;
 377 +
 378 +out_no_match:
 379 +       spin_unlock(&state.lock);
 380 +       return 0;
 381 +
 382 +out_match:
 383 +       spin_unlock(&state.lock);
 384 +       return 1;
 385 +}
 386 +
 387 +static int ipt_psd_checkentry(const char *tablename,
 388 +                             const struct ipt_ip *e,
 389 +                             void *matchinfo,
 390 +                             unsigned int matchsize,
 391 +                             unsigned int hook_mask)
 392 +{
 393 +/*     const struct ipt_psd_info *psdinfo = targinfo;*/
 394 +
 395 +       /* we accept TCP only */
 396 +/*     if (e->ip.proto != IPPROTO_TCP) { */
 397 +/*             DEBUGP("PSD: specified protocol may be TCP only\n"); */
 398 +/*             return 0; */
 399 +/*     } */
 400 +
 401 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_psd_info))) {
 402 +               DEBUGP("PSD: matchsize %u != %u\n",
 403 +                      matchsize,
 404 +                      IPT_ALIGN(sizeof(struct ipt_psd_info)));
 405 +               return 0;
 406 +       }
 407 +
 408 +       return 1;
 409 +}
 410 +
 411 +static struct ipt_match ipt_psd_reg = {
 412 +       .name = "psd",
 413 +       .match = ipt_psd_match,
 414 +       .checkentry = ipt_psd_checkentry,
 415 +       .me = THIS_MODULE };
 416 +
 417 +static int __init init(void)
 418 +{
 419 +       if (ipt_register_match(&ipt_psd_reg))
 420 +               return -EINVAL;
 421 +
 422 +       memset(&state, 0, sizeof(state));
 423 +
 424 +       spin_lock_init(&(state.lock));
 425 +
 426 +       printk("netfilter PSD loaded - (c) astaro AG\n");
 427 +       return 0;
 428 +}
 429 +
 430 +static void __exit fini(void)
 431 +{
 432 +       ipt_unregister_match(&ipt_psd_reg);
 433 +       printk("netfilter PSD unloaded - (c) astaro AG\n");
 434 +}
 435 +
 436 +module_init(init);
 437 +module_exit(fini);