2.6.1-rc2-NF-psd-20040107.patch

   1 diff -Nur linux-2.6.1-rc2.org/include/linux/netfilter_ipv4/ipt_psd.h linux-2.6.1-rc2/include/linux/netfilter_ipv4/ipt_psd.h
   2 --- linux-2.6.1-rc2.org/include/linux/netfilter_ipv4/ipt_psd.h  1970-01-01 01:00:00.000000000 +0100
   3 +++ linux-2.6.1-rc2/include/linux/netfilter_ipv4/ipt_psd.h      2004-01-07 18:17:50.030389768 +0100
   4 @@ -0,0 +1,40 @@
   5 +#ifndef _IPT_PSD_H
   6 +#define _IPT_PSD_H
   7 +
   8 +#include <linux/param.h>
   9 +#include <linux/types.h>
  10 +
  11 +/*
  12 + * High port numbers have a lower weight to reduce the frequency of false
  13 + * positives, such as from passive mode FTP transfers.
  14 + */
  15 +#define PORT_WEIGHT_PRIV               3
  16 +#define PORT_WEIGHT_HIGH               1
  17 +
  18 +/*
  19 + * Port scan detection thresholds: at least COUNT ports need to be scanned
  20 + * from the same source, with no longer than DELAY ticks between ports.
  21 + */
  22 +#define SCAN_MIN_COUNT                 7
  23 +#define SCAN_MAX_COUNT                 (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
  24 +#define SCAN_WEIGHT_THRESHOLD          SCAN_MAX_COUNT
  25 +#define SCAN_DELAY_THRESHOLD           (HZ * 3)
  26 +
  27 +/*
  28 + * Keep track of up to LIST_SIZE source addresses, using a hash table of
  29 + * HASH_SIZE entries for faster lookups, but limiting hash collisions to
  30 + * HASH_MAX source addresses per the same hash value.
  31 + */
  32 +#define LIST_SIZE                      0x100
  33 +#define HASH_LOG                       9
  34 +#define HASH_SIZE                      (1 << HASH_LOG)
  35 +#define HASH_MAX                       0x10
  36 +
  37 +struct ipt_psd_info {
  38 +       unsigned int weight_threshold;
  39 +       unsigned int delay_threshold;
  40 +       unsigned short lo_ports_weight;
  41 +       unsigned short hi_ports_weight;
  42 +};
  43 +
  44 +#endif /*_IPT_PSD_H*/
  45 diff -Nur linux-2.6.1-rc2.org/net/ipv4/netfilter/ipt_psd.c linux-2.6.1-rc2/net/ipv4/netfilter/ipt_psd.c
  46 --- linux-2.6.1-rc2.org/net/ipv4/netfilter/ipt_psd.c    1970-01-01 01:00:00.000000000 +0100
  47 +++ linux-2.6.1-rc2/net/ipv4/netfilter/ipt_psd.c        2004-01-07 18:17:50.031389616 +0100
  48 @@ -0,0 +1,361 @@
  49 +/*
  50 +  This is a module which is used for PSD (portscan detection)
  51 +  Derived from scanlogd v2.1 written by Solar Designer <solar@false.com>
  52 +  and LOG target module.
  53 +
  54 +  Copyright (C) 2000,2001 astaro AG
  55 +
  56 +  This file is distributed under the terms of the GNU General Public
  57 +  License (GPL). Copies of the GPL can be obtained from:
  58 +     ftp://prep.ai.mit.edu/pub/gnu/GPL
  59 +
  60 +  2000-05-04 Markus Hennig <hennig@astaro.de> : initial
  61 +  2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
  62 +  2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
  63 +  2001-01-02 Dennis Koslowski <koslowski@astaro.de> : output modified
  64 +  2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
  65 +*/
  66 +
  67 +#include <linux/module.h>
  68 +#include <linux/skbuff.h>
  69 +#include <linux/ip.h>
  70 +#include <net/tcp.h>
  71 +#include <linux/spinlock.h>
  72 +#include <linux/netfilter_ipv4/ip_tables.h>
  73 +#include <linux/netfilter_ipv4/ipt_psd.h>
  74 +
  75 +#if 0
  76 +#define DEBUGP printk
  77 +#else
  78 +#define DEBUGP(format, args...)
  79 +#endif
  80 +
  81 +MODULE_LICENSE("GPL");
  82 +MODULE_AUTHOR("Dennis Koslowski <koslowski@astaro.com>");
  83 +
  84 +#define HF_DADDR_CHANGING   0x01
  85 +#define HF_SPORT_CHANGING   0x02
  86 +#define HF_TOS_CHANGING            0x04
  87 +#define HF_TTL_CHANGING            0x08
  88 +
  89 +/*
  90 + * Information we keep per each target port
  91 + */
  92 +struct port {
  93 +       u_int16_t number;      /* port number */
  94 +       u_int8_t proto;        /* protocol number */
  95 +       u_int8_t and_flags;    /* tcp ANDed flags */
  96 +       u_int8_t or_flags;     /* tcp ORed flags */
  97 +};
  98 +
  99 +/*
 100 + * Information we keep per each source address.
 101 + */
 102 +struct host {
 103 +       struct host *next;              /* Next entry with the same hash */
 104 +       clock_t timestamp;              /* Last update time */
 105 +       struct in_addr src_addr;        /* Source address */
 106 +       struct in_addr dest_addr;       /* Destination address */
 107 +       unsigned short src_port;        /* Source port */
 108 +       int count;                      /* Number of ports in the list */
 109 +       int weight;                     /* Total weight of ports in the list */
 110 +       struct port ports[SCAN_MAX_COUNT - 1];  /* List of ports */
 111 +       unsigned char tos;              /* TOS */
 112 +       unsigned char ttl;              /* TTL */
 113 +       unsigned char flags;            /* HF_ flags bitmask */
 114 +};
 115 +
 116 +/*
 117 + * State information.
 118 + */
 119 +static struct {
 120 +       spinlock_t lock;
 121 +       struct host list[LIST_SIZE];    /* List of source addresses */
 122 +       struct host *hash[HASH_SIZE];   /* Hash: pointers into the list */
 123 +       int index;                      /* Oldest entry to be replaced */
 124 +} state;
 125 +
 126 +/*
 127 + * Convert an IP address into a hash table index.
 128 + */
 129 +static inline int hashfunc(struct in_addr addr)
 130 +{
 131 +       unsigned int value;
 132 +       int hash;
 133 +
 134 +       value = addr.s_addr;
 135 +       hash = 0;
 136 +       do {
 137 +               hash ^= value;
 138 +       } while ((value >>= HASH_LOG));
 139 +
 140 +       return hash & (HASH_SIZE - 1);
 141 +}
 142 +
 143 +static int
 144 +ipt_psd_match(const struct sk_buff *pskb,
 145 +             const struct net_device *in,
 146 +             const struct net_device *out,
 147 +             const void *matchinfo,
 148 +             int offset,
 149 +             const void *hdr,
 150 +             u_int16_t datalen,
 151 +             int *hotdrop)
 152 +{
 153 +       struct iphdr *ip_hdr;
 154 +       struct tcphdr *tcp_hdr;
 155 +       struct in_addr addr;
 156 +       u_int16_t src_port,dest_port;
 157 +       u_int8_t tcp_flags, proto;
 158 +       clock_t now;
 159 +       struct host *curr, *last, **head;
 160 +       int hash, index, count;
 161 +
 162 +       /* Parameters from userspace */
 163 +       const struct ipt_psd_info *psdinfo = matchinfo;
 164 +
 165 +       /* IP header */
 166 +       ip_hdr = pskb->nh.iph;
 167 +
 168 +       /* Sanity check */
 169 +       if (ntohs(ip_hdr->frag_off) & IP_OFFSET) {
 170 +               DEBUGP("PSD: sanity check failed\n");
 171 +               return 0;
 172 +       }
 173 +
 174 +       /* TCP or UDP ? */
 175 +       proto = ip_hdr->protocol;
 176 +
 177 +       if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) {
 178 +               DEBUGP("PSD: protocol not supported\n");
 179 +               return 0;
 180 +       }
 181 +
 182 +       /* Get the source address, source & destination ports, and TCP flags */
 183 +
 184 +       addr.s_addr = ip_hdr->saddr;
 185 +
 186 +       tcp_hdr = (struct tcphdr*)((u_int32_t *)ip_hdr + ip_hdr->ihl);
 187 +
 188 +       /* Yep, it´s dirty */
 189 +       src_port = tcp_hdr->source;
 190 +       dest_port = tcp_hdr->dest;
 191 +
 192 +       if (proto == IPPROTO_TCP) {
 193 +               tcp_flags = *((u_int8_t*)tcp_hdr + 13);
 194 +       }
 195 +       else {
 196 +               tcp_flags = 0x00;
 197 +       }
 198 +
 199 +       /* We're using IP address 0.0.0.0 for a special purpose here, so don't let
 200 +        * them spoof us. [DHCP needs this feature - HW] */
 201 +       if (!addr.s_addr) {
 202 +               DEBUGP("PSD: spoofed source address (0.0.0.0)\n");
 203 +               return 0;
 204 +       }
 205 +
 206 +       /* Use jiffies here not to depend on someone setting the time while we're
 207 +        * running; we need to be careful with possible return value overflows. */
 208 +       now = jiffies;
 209 +
 210 +       spin_lock(&state.lock);
 211 +
 212 +       /* Do we know this source address already? */
 213 +       count = 0;
 214 +       last = NULL;
 215 +       if ((curr = *(head = &state.hash[hash = hashfunc(addr)])))
 216 +               do {
 217 +                       if (curr->src_addr.s_addr == addr.s_addr) break;
 218 +                       count++;
 219 +                       if (curr->next) last = curr;
 220 +               } while ((curr = curr->next));
 221 +
 222 +       if (curr) {
 223 +
 224 +               /* We know this address, and the entry isn't too old. Update it. */
 225 +               if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
 226 +                   time_after_eq(now, curr->timestamp)) {
 227 +
 228 +                       /* Just update the appropriate list entry if we've seen this port already */
 229 +                       for (index = 0; index < curr->count; index++) {
 230 +                               if (curr->ports[index].number == dest_port) {
 231 +                                       curr->ports[index].proto = proto;
 232 +                                       curr->ports[index].and_flags &= tcp_flags;
 233 +                                       curr->ports[index].or_flags |= tcp_flags;
 234 +                                       goto out_no_match;
 235 +                               }
 236 +                       }
 237 +
 238 +                       /* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */
 239 +                       if (proto == IPPROTO_TCP && (tcp_hdr->ack || tcp_hdr->rst))
 240 +                               goto out_no_match;
 241 +
 242 +                       /* Packet to a new port, and not TCP/ACK: update the timestamp */
 243 +                       curr->timestamp = now;
 244 +
 245 +                       /* Logged this scan already? Then drop the packet. */
 246 +                       if (curr->weight >= psdinfo->weight_threshold)
 247 +                               goto out_match;
 248 +
 249 +                       /* Specify if destination address, source port, TOS or TTL are not fixed */
 250 +                       if (curr->dest_addr.s_addr != ip_hdr->daddr)
 251 +                               curr->flags |= HF_DADDR_CHANGING;
 252 +                       if (curr->src_port != src_port)
 253 +                               curr->flags |= HF_SPORT_CHANGING;
 254 +                       if (curr->tos != ip_hdr->tos)
 255 +                               curr->flags |= HF_TOS_CHANGING;
 256 +                       if (curr->ttl != ip_hdr->ttl)
 257 +                               curr->flags |= HF_TTL_CHANGING;
 258 +
 259 +                       /* Update the total weight */
 260 +                       curr->weight += (ntohs(dest_port) < 1024) ?
 261 +                               psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
 262 +
 263 +                       /* Got enough destination ports to decide that this is a scan? */
 264 +                       /* Then log it and drop the packet. */
 265 +                       if (curr->weight >= psdinfo->weight_threshold)
 266 +                               goto out_match;
 267 +
 268 +                       /* Remember the new port */
 269 +                       if (curr->count < SCAN_MAX_COUNT) {
 270 +                               curr->ports[curr->count].number = dest_port;
 271 +                               curr->ports[curr->count].proto = proto;
 272 +                               curr->ports[curr->count].and_flags = tcp_flags;
 273 +                               curr->ports[curr->count].or_flags = tcp_flags;
 274 +                               curr->count++;
 275 +                       }
 276 +
 277 +                       goto out_no_match;
 278 +               }
 279 +
 280 +               /* We know this address, but the entry is outdated. Mark it unused, and
 281 +                * remove from the hash table. We'll allocate a new entry instead since
 282 +                * this one might get re-used too soon. */
 283 +               curr->src_addr.s_addr = 0;
 284 +               if (last)
 285 +                       last->next = last->next->next;
 286 +               else if (*head)
 287 +                       *head = (*head)->next;
 288 +               last = NULL;
 289 +       }
 290 +
 291 +       /* We don't need an ACK from a new source address */
 292 +       if (proto == IPPROTO_TCP && tcp_hdr->ack)
 293 +               goto out_no_match;
 294 +
 295 +       /* Got too many source addresses with the same hash value? Then remove the
 296 +        * oldest one from the hash table, so that they can't take too much of our
 297 +        * CPU time even with carefully chosen spoofed IP addresses. */
 298 +       if (count >= HASH_MAX && last) last->next = NULL;
 299 +
 300 +       /* We're going to re-use the oldest list entry, so remove it from the hash
 301 +        * table first (if it is really already in use, and isn't removed from the
 302 +        * hash table already because of the HASH_MAX check above). */
 303 +
 304 +       /* First, find it */
 305 +       if (state.list[state.index].src_addr.s_addr)
 306 +               head = &state.hash[hashfunc(state.list[state.index].src_addr)];
 307 +       else
 308 +               head = &last;
 309 +       last = NULL;
 310 +       if ((curr = *head))
 311 +       do {
 312 +               if (curr == &state.list[state.index]) break;
 313 +               last = curr;
 314 +       } while ((curr = curr->next));
 315 +
 316 +       /* Then, remove it */
 317 +       if (curr) {
 318 +               if (last)
 319 +                       last->next = last->next->next;
 320 +               else if (*head)
 321 +                       *head = (*head)->next;
 322 +       }
 323 +
 324 +       /* Get our list entry */
 325 +       curr = &state.list[state.index++];
 326 +       if (state.index >= LIST_SIZE) state.index = 0;
 327 +
 328 +       /* Link it into the hash table */
 329 +       head = &state.hash[hash];
 330 +       curr->next = *head;
 331 +       *head = curr;
 332 +
 333 +       /* And fill in the fields */
 334 +       curr->timestamp = now;
 335 +       curr->src_addr = addr;
 336 +       curr->dest_addr.s_addr = ip_hdr->daddr;
 337 +       curr->src_port = src_port;
 338 +       curr->count = 1;
 339 +       curr->weight = (ntohs(dest_port) < 1024) ?
 340 +               psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
 341 +       curr->ports[0].number = dest_port;
 342 +       curr->ports[0].proto = proto;
 343 +       curr->ports[0].and_flags = tcp_flags;
 344 +       curr->ports[0].or_flags = tcp_flags;
 345 +       curr->tos = ip_hdr->tos;
 346 +       curr->ttl = ip_hdr->ttl;
 347 +
 348 +out_no_match:
 349 +       spin_unlock(&state.lock);
 350 +       return 0;
 351 +
 352 +out_match:
 353 +       spin_unlock(&state.lock);
 354 +       return 1;
 355 +}
 356 +
 357 +static int ipt_psd_checkentry(const char *tablename,
 358 +                             const struct ipt_ip *e,
 359 +                             void *matchinfo,
 360 +                             unsigned int matchsize,
 361 +                             unsigned int hook_mask)
 362 +{
 363 +/*     const struct ipt_psd_info *psdinfo = targinfo;*/
 364 +
 365 +       /* we accept TCP only */
 366 +/*     if (e->ip.proto != IPPROTO_TCP) { */
 367 +/*             DEBUGP("PSD: specified protocol may be TCP only\n"); */
 368 +/*             return 0; */
 369 +/*     } */
 370 +
 371 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_psd_info))) {
 372 +               DEBUGP("PSD: matchsize %u != %u\n",
 373 +                      matchsize,
 374 +                      IPT_ALIGN(sizeof(struct ipt_psd_info)));
 375 +               return 0;
 376 +       }
 377 +
 378 +       return 1;
 379 +}
 380 +
 381 +static struct ipt_match ipt_psd_reg = {
 382 +       {NULL, NULL},
 383 +       "psd",
 384 +       ipt_psd_match,
 385 +       ipt_psd_checkentry,
 386 +       NULL,
 387 +       THIS_MODULE };
 388 +
 389 +static int __init init(void)
 390 +{
 391 +       if (ipt_register_match(&ipt_psd_reg))
 392 +               return -EINVAL;
 393 +
 394 +       memset(&state, 0, sizeof(state));
 395 +
 396 +       spin_lock_init(&(state.lock));
 397 +
 398 +       printk("netfilter PSD loaded - (c) astaro AG\n");
 399 +       return 0;
 400 +}
 401 +
 402 +static void __exit fini(void)
 403 +{
 404 +       ipt_unregister_match(&ipt_psd_reg);
 405 +       printk("netfilter PSD unloaded - (c) astaro AG\n");
 406 +}
 407 +
 408 +module_init(init);
 409 +module_exit(fini);
 410 diff -Nur linux-2.6.1-rc2.org/net/ipv4/netfilter/Kconfig linux-2.6.1-rc2/net/ipv4/netfilter/Kconfig
 411 --- linux-2.6.1-rc2.org/net/ipv4/netfilter/Kconfig      2004-01-07 18:05:30.207859888 +0100
 412 +++ linux-2.6.1-rc2/net/ipv4/netfilter/Kconfig  2004-01-07 18:17:50.034389160 +0100
 413 @@ -658,5 +658,35 @@
 414
 415           Fingerprints can be downloaded from http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os
 416
 417 +config IP_NF_MATCH_PSD
 418 +       tristate  'psd match support'
 419 +       depends on IP_NF_IPTABLES
 420 +         help
 421 +         This option adds a `psd' match, which supplies portscan
 422 +         detection match (psd). This match will attempt to detect TCP and UDP
 423 +         port scans. This match was derived from Solar Designer's scanlogd.
 424 +
 425 +         Suppported options are:
 426 +
 427 +         --psd-weight-threshold <threshold>
 428 +
 429 +           Total weight of the latest TCP/UDP packets with different
 430 +           destination ports coming from the same host to be treated as port
 431 +           scan sequence.
 432 +
 433 +         --psd-delay-threshold <delay>
 434 +
 435 +           Delay (in hundredths of second) for the packets with different
 436 +           destination ports coming from the same host to be treated as
 437 +           possible port scan subsequence.
 438 +
 439 +         --psd-lo-ports-weight <weight>
 440 +
 441 +           Weight of the packet with privileged (<=1024) destination port.
 442 +
 443 +         --psd-hi-ports-weight <weight>
 444 +
 445 +           Weight of the packet with non-priviliged destination port.
 446 +
 447  endmenu
 448
 449 diff -Nur linux-2.6.1-rc2.org/net/ipv4/netfilter/Makefile linux-2.6.1-rc2/net/ipv4/netfilter/Makefile
 450 --- linux-2.6.1-rc2.org/net/ipv4/netfilter/Makefile     2004-01-07 18:05:30.207859888 +0100
 451 +++ linux-2.6.1-rc2/net/ipv4/netfilter/Makefile 2004-01-07 18:17:50.035389008 +0100
 452 @@ -51,6 +51,8 @@
 453  obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
 454  obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
 455
 456 +obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
 457 +
 458  obj-$(CONFIG_IP_NF_MATCH_OSF) += ipt_osf.o
 459
 460