netfilter-2.6/patch-o-matic-ng/trunk: include/linux/netfilter_ipv4/ipt_TTL.h
include/linux/netfilter...
pluto
cvs at pld-linux.org
Thu Jul 28 11:38:29 CEST 2005
Author: pluto
Date: Thu Jul 28 11:38:24 2005
New Revision: 6249
Added:
netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_TTL.h
netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_XOR.h
netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_psd.h
netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_quota.h
netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_TTL.c
netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_XOR.c
netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_psd.c
netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_quota.c
Modified:
netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/Kconfig
netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/Makefile
netfilter-2.6/patch-o-matic-ng/trunk/status
Log:
- psd, quota, TTL, XOR.
Added: netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_TTL.h
==============================================================================
--- (empty file)
+++ netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_TTL.h Thu Jul 28 11:38:24 2005
@@ -0,0 +1,21 @@
+/* TTL modification module for IP tables
+ * (C) 2000 by Harald Welte <laforge at gnumonks.org> */
+
+#ifndef _IPT_TTL_H
+#define _IPT_TTL_H
+
+enum {
+ IPT_TTL_SET = 0,
+ IPT_TTL_INC,
+ IPT_TTL_DEC
+};
+
+#define IPT_TTL_MAXMODE IPT_TTL_DEC
+
+struct ipt_TTL_info {
+ u_int8_t mode;
+ u_int8_t ttl;
+};
+
+
+#endif
Added: netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_XOR.h
==============================================================================
--- (empty file)
+++ netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_XOR.h Thu Jul 28 11:38:24 2005
@@ -0,0 +1,9 @@
+#ifndef _IPT_XOR_H
+#define _IPT_XOR_H
+
+struct ipt_XOR_info {
+ char key[30];
+ u_int8_t block_size;
+};
+
+#endif /* _IPT_XOR_H */
Added: netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_psd.h
==============================================================================
--- (empty file)
+++ netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_psd.h Thu Jul 28 11:38:24 2005
@@ -0,0 +1,40 @@
+#ifndef _IPT_PSD_H
+#define _IPT_PSD_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+/*
+ * High port numbers have a lower weight to reduce the frequency of false
+ * positives, such as from passive mode FTP transfers.
+ */
+#define PORT_WEIGHT_PRIV 3
+#define PORT_WEIGHT_HIGH 1
+
+/*
+ * Port scan detection thresholds: at least COUNT ports need to be scanned
+ * from the same source, with no longer than DELAY ticks between ports.
+ */
+#define SCAN_MIN_COUNT 7
+#define SCAN_MAX_COUNT (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
+#define SCAN_WEIGHT_THRESHOLD SCAN_MAX_COUNT
+#define SCAN_DELAY_THRESHOLD (300) /* old usage of HZ here was erroneously and broke under uml */
+
+/*
+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
+ * HASH_MAX source addresses per the same hash value.
+ */
+#define LIST_SIZE 0x100
+#define HASH_LOG 9
+#define HASH_SIZE (1 << HASH_LOG)
+#define HASH_MAX 0x10
+
+struct ipt_psd_info {
+ unsigned int weight_threshold;
+ unsigned int delay_threshold;
+ unsigned short lo_ports_weight;
+ unsigned short hi_ports_weight;
+};
+
+#endif /*_IPT_PSD_H*/
Added: netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_quota.h
==============================================================================
--- (empty file)
+++ netfilter-2.6/patch-o-matic-ng/trunk/include/linux/netfilter_ipv4/ipt_quota.h Thu Jul 28 11:38:24 2005
@@ -0,0 +1,12 @@
+#ifndef _IPT_QUOTA_H
+#define _IPT_QUOTA_H
+
+/* print debug info in both kernel/netfilter module & iptable library */
+//#define DEBUG_IPT_QUOTA
+
+struct ipt_quota_info {
+ u_int64_t quota;
+ struct ipt_quota_info *master;
+};
+
+#endif /*_IPT_QUOTA_H*/
Modified: netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/Kconfig
==============================================================================
--- netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/Kconfig (original)
+++ netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/Kconfig Thu Jul 28 11:38:24 2005
@@ -1027,5 +1027,46 @@
If you want to compile it as a module, say M here and read
<file:Documentation/modules.txt>. If unsure, say `N'.
+config IP_NF_MATCH_PSD
+ tristate 'psd match support'
+ depends on IP_NF_IPTABLES
+ help
+ This option adds a `psd' match, which allows you to create rules in
+ any iptables table wich will detect TCP and UDP port scans.
+
+ If you want to compile it as a module, say M here and read
+ Documentation/modules.txt. If unsure, say `N'.
+
+config IP_NF_MATCH_QUOTA
+ tristate 'quota match support'
+ depends on IP_NF_IPTABLES
+ help
+ This match implements network quotas.
+
+ If you want to compile it as a module, say M here and read
+ Documentation/modules.txt. If unsure, say `N'.
+
+
+config IP_NF_TARGET_TTL
+ tristate 'TTL target support'
+ depends on IP_NF_MANGLE
+ help
+ This option adds a `TTL' target, which enables the user to set
+ the TTL value or increment / decrement the TTL value by a given
+ amount.
+
+ If you want to compile it as a module, say M here and read
+ Documentation/modules.txt. If unsure, say `N'.
+
+config IP_NF_TARGET_XOR
+ tristate 'XOR target support'
+ depends on IP_NF_MANGLE
+ help
+ This option adds a `XOR' target, which can encrypt TCP and
+ UDP traffic using a simple XOR encryption.
+
+ If you want to compile it as a module, say M here and read
+ Documentation/modules.txt. If unsure, say `N'.
+
endmenu
Modified: netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/Makefile
==============================================================================
--- netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/Makefile (original)
+++ netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/Makefile Thu Jul 28 11:38:24 2005
@@ -51,6 +51,7 @@
# matches
obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
+obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
obj-$(CONFIG_IP_NF_MATCH_GEOIP) += ipt_geoip.o
obj-$(CONFIG_IP_NF_MATCH_HASHLIMIT) += ipt_hashlimit.o
@@ -64,6 +65,8 @@
obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
+obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
+
obj-$(CONFIG_IP_NF_MATCH_TIME) += ipt_time.o
@@ -106,6 +109,8 @@
obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
+obj-$(CONFIG_IP_NF_TARGET_XOR) += ipt_XOR.o
+obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
obj-$(CONFIG_IP_NF_TARGET_CONNMARK) += ipt_CONNMARK.o
obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
Added: netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_TTL.c
==============================================================================
--- (empty file)
+++ netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_TTL.c Thu Jul 28 11:38:24 2005
@@ -0,0 +1,120 @@
+/* TTL modification target for IP tables
+ * (C) 2000 by Harald Welte <laforge at gnumonks.org>
+ *
+ * Version: $Revision: 320 $
+ *
+ * This software is distributed under the terms of GNU GPL
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/checksum.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_TTL.h>
+
+MODULE_AUTHOR("Harald Welte <laforge at gnumonks.org>");
+MODULE_DESCRIPTION("IP tables TTL modification module");
+MODULE_LICENSE("GPL");
+
+static unsigned int
+ipt_ttl_target(struct sk_buff **pskb, const struct net_device *in,
+ const struct net_device *out, unsigned int hooknum,
+ const void *targinfo, void *userinfo)
+{
+ struct iphdr *iph;
+ const struct ipt_TTL_info *info = targinfo;
+ u_int16_t diffs[2];
+ int new_ttl;
+
+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
+ return NF_DROP;
+
+ iph = (*pskb)->nh.iph;
+
+ switch (info->mode) {
+ case IPT_TTL_SET:
+ new_ttl = info->ttl;
+ break;
+ case IPT_TTL_INC:
+ new_ttl = iph->ttl + info->ttl;
+ if (new_ttl > 255)
+ new_ttl = 255;
+ break;
+ case IPT_TTL_DEC:
+ new_ttl = iph->ttl - info->ttl;
+ if (new_ttl < 0)
+ new_ttl = 0;
+ break;
+ default:
+ new_ttl = iph->ttl;
+ break;
+ }
+
+ if (new_ttl != iph->ttl) {
+ diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
+ iph->ttl = new_ttl;
+ diffs[1] = htons(((unsigned)iph->ttl) << 8);
+ iph->check = csum_fold(csum_partial((char *)diffs,
+ sizeof(diffs),
+ iph->check^0xFFFF));
+ (*pskb)->nfcache |= NFC_ALTERED;
+ }
+
+ return IPT_CONTINUE;
+}
+
+static int ipt_ttl_checkentry(const char *tablename,
+ const struct ipt_entry *e,
+ void *targinfo,
+ unsigned int targinfosize,
+ unsigned int hook_mask)
+{
+ struct ipt_TTL_info *info = targinfo;
+
+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
+ printk(KERN_WARNING "TTL: targinfosize %u != %Zu\n",
+ targinfosize,
+ IPT_ALIGN(sizeof(struct ipt_TTL_info)));
+ return 0;
+ }
+
+ if (strcmp(tablename, "mangle")) {
+ printk(KERN_WARNING "TTL: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
+ return 0;
+ }
+
+ if (info->mode > IPT_TTL_MAXMODE) {
+ printk(KERN_WARNING "TTL: invalid or unknown Mode %u\n",
+ info->mode);
+ return 0;
+ }
+
+ if ((info->mode != IPT_TTL_SET) && (info->ttl == 0)) {
+ printk(KERN_WARNING "TTL: increment/decrement doesn't make sense with value 0\n");
+ return 0;
+ }
+
+ return 1;
+}
+
+static struct ipt_target ipt_TTL = {
+ .name = "TTL",
+ .target = ipt_ttl_target,
+ .checkentry = ipt_ttl_checkentry,
+ .me = THIS_MODULE
+};
+
+static int __init init(void)
+{
+ return ipt_register_target(&ipt_TTL);
+}
+
+static void __exit fini(void)
+{
+ ipt_unregister_target(&ipt_TTL);
+}
+
+module_init(init);
+module_exit(fini);
Added: netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_XOR.c
==============================================================================
--- (empty file)
+++ netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_XOR.c Thu Jul 28 11:38:24 2005
@@ -0,0 +1,117 @@
+/* XOR target for IP tables
+ * (C) 2000 by Tim Vandermeersch <Tim.Vandermeersch at pandora.be>
+ * Based on ipt_TTL.c
+ *
+ * Version 1.0
+ *
+ * This software is distributed under the terms of GNU GPL
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_XOR.h>
+
+MODULE_AUTHOR("Tim Vandermeersch <Tim.Vandermeersch at pandora.be>");
+MODULE_DESCRIPTION("IP tables XOR module");
+MODULE_LICENSE("GPL");
+
+static unsigned int
+ipt_xor_target(struct sk_buff **pskb,
+ const struct net_device *in, const struct net_device *out,
+ unsigned int hooknum, const void *targinfo, void *userinfo)
+{
+ struct ipt_XOR_info *info = (void *) targinfo;
+ struct iphdr *iph;
+ struct tcphdr *tcph;
+ struct udphdr *udph;
+ int i, j, k;
+
+ if (!skb_ip_make_writable(pskb, (*pskb)->len))
+ return NF_DROP;
+
+ iph = (*pskb)->nh.iph;
+
+ if (iph->protocol == IPPROTO_TCP) {
+ tcph = (struct tcphdr *) ((*pskb)->data + iph->ihl*4);
+ for (i=0, j=0; i<(ntohs(iph->tot_len) - iph->ihl*4 - tcph->doff*4); ) {
+ for (k=0; k<=info->block_size; k++) {
+ (*pskb)->data[ iph->ihl*4 + tcph->doff*4 + i ] ^=
+ info->key[j];
+ i++;
+ }
+ j++;
+ if (info->key[j] == 0x00)
+ j = 0;
+ }
+ } else if (iph->protocol == IPPROTO_UDP) {
+ udph = (struct udphdr *) ((*pskb)->data + iph->ihl*4);
+ for (i=0, j=0; i<(ntohs(udph->len)-8); ) {
+ for (k=0; k<=info->block_size; k++) {
+ (*pskb)->data[ iph->ihl*4 + sizeof(struct udphdr) + i ] ^=
+ info->key[j];
+ i++;
+ }
+ j++;
+ if (info->key[j] == 0x00)
+ j = 0;
+ }
+ }
+
+ return IPT_CONTINUE;
+}
+
+static int ipt_xor_checkentry(const char *tablename, const struct ipt_entry *e,
+ void *targinfo, unsigned int targinfosize,
+ unsigned int hook_mask)
+{
+ struct ipt_XOR_info *info = targinfo;
+
+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_XOR_info))) {
+ printk(KERN_WARNING "XOR: targinfosize %u != %Zu\n",
+ targinfosize, IPT_ALIGN(sizeof(struct ipt_XOR_info)));
+ return 0;
+ }
+
+ if (strcmp(tablename, "mangle")) {
+ printk(KERN_WARNING "XOR: can only be called from"
+ "\"mangle\" table, not \"%s\"\n", tablename);
+ return 0;
+ }
+
+ if (!strcmp(info->key, "")) {
+ printk(KERN_WARNING "XOR: You must specify a key");
+ return 0;
+ }
+
+ if (info->block_size == 0) {
+ printk(KERN_WARNING "XOR: You must specify a block-size");
+ return 0;
+ }
+
+ return 1;
+}
+
+static struct ipt_target ipt_XOR = {
+ .name = "XOR",
+ .target = ipt_xor_target,
+ .checkentry = ipt_xor_checkentry,
+ .me = THIS_MODULE,
+};
+
+static int __init init(void)
+{
+ return ipt_register_target(&ipt_XOR);
+}
+
+static void __exit fini(void)
+{
+ ipt_unregister_target(&ipt_XOR);
+}
+
+module_init(init);
+module_exit(fini);
Added: netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_psd.c
==============================================================================
--- (empty file)
+++ netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_psd.c Thu Jul 28 11:38:24 2005
@@ -0,0 +1,358 @@
+/*
+ This is a module which is used for PSD (portscan detection)
+ Derived from scanlogd v2.1 written by Solar Designer <solar at false.com>
+ and LOG target module.
+
+ Copyright (C) 2000,2001 astaro AG
+
+ This file is distributed under the terms of the GNU General Public
+ License (GPL). Copies of the GPL can be obtained from:
+ ftp://prep.ai.mit.edu/pub/gnu/GPL
+
+ 2000-05-04 Markus Hennig <hennig at astaro.de> : initial
+ 2000-08-18 Dennis Koslowski <koslowski at astaro.de> : first release
+ 2000-12-01 Dennis Koslowski <koslowski at astaro.de> : UDP scans detection added
+ 2001-01-02 Dennis Koslowski <koslowski at astaro.de> : output modified
+ 2001-02-04 Jan Rekorajski <baggins at pld.org.pl> : converted from target to match
+ 2004-05-05 Martijn Lievaart <m at rtij.nl> : ported to 2.6
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_psd.h>
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Dennis Koslowski <koslowski at astaro.com>");
+
+#define HF_DADDR_CHANGING 0x01
+#define HF_SPORT_CHANGING 0x02
+#define HF_TOS_CHANGING 0x04
+#define HF_TTL_CHANGING 0x08
+
+/*
+ * Information we keep per each target port
+ */
+struct port {
+ u_int16_t number; /* port number */
+ u_int8_t proto; /* protocol number */
+ u_int8_t and_flags; /* tcp ANDed flags */
+ u_int8_t or_flags; /* tcp ORed flags */
+};
+
+/*
+ * Information we keep per each source address.
+ */
+struct host {
+ struct host *next; /* Next entry with the same hash */
+ clock_t timestamp; /* Last update time */
+ struct in_addr src_addr; /* Source address */
+ struct in_addr dest_addr; /* Destination address */
+ unsigned short src_port; /* Source port */
+ int count; /* Number of ports in the list */
+ int weight; /* Total weight of ports in the list */
+ struct port ports[SCAN_MAX_COUNT - 1]; /* List of ports */
+ unsigned char tos; /* TOS */
+ unsigned char ttl; /* TTL */
+ unsigned char flags; /* HF_ flags bitmask */
+};
+
+/*
+ * State information.
+ */
+static struct {
+ spinlock_t lock;
+ struct host list[LIST_SIZE]; /* List of source addresses */
+ struct host *hash[HASH_SIZE]; /* Hash: pointers into the list */
+ int index; /* Oldest entry to be replaced */
+} state;
+
+/*
+ * Convert an IP address into a hash table index.
+ */
+static inline int hashfunc(struct in_addr addr)
+{
+ unsigned int value;
+ int hash;
+
+ value = addr.s_addr;
+ hash = 0;
+ do {
+ hash ^= value;
+ } while ((value >>= HASH_LOG));
+
+ return hash & (HASH_SIZE - 1);
+}
+
+static int
+ipt_psd_match(const struct sk_buff *pskb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const void *matchinfo,
+ int offset,
+ int *hotdrop)
+{
+ struct iphdr *ip_hdr;
+ struct tcphdr *tcp_hdr;
+ struct in_addr addr;
+ u_int16_t src_port,dest_port;
+ u_int8_t tcp_flags, proto;
+ clock_t now;
+ struct host *curr, *last, **head;
+ int hash, index, count;
+
+ /* Parameters from userspace */
+ const struct ipt_psd_info *psdinfo = matchinfo;
+
+ /* IP header */
+ ip_hdr = pskb->nh.iph;
+
+ /* Sanity check */
+ if (ntohs(ip_hdr->frag_off) & IP_OFFSET) {
+ DEBUGP("PSD: sanity check failed\n");
+ return 0;
+ }
+
+ /* TCP or UDP ? */
+ proto = ip_hdr->protocol;
+
+ if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) {
+ DEBUGP("PSD: protocol not supported\n");
+ return 0;
+ }
+
+ /* Get the source address, source & destination ports, and TCP flags */
+
+ addr.s_addr = ip_hdr->saddr;
+
+ tcp_hdr = (struct tcphdr*)((u_int32_t *)ip_hdr + ip_hdr->ihl);
+
+ /* Yep, it´s dirty */
+ src_port = tcp_hdr->source;
+ dest_port = tcp_hdr->dest;
+
+ if (proto == IPPROTO_TCP) {
+ tcp_flags = *((u_int8_t*)tcp_hdr + 13);
+ }
+ else {
+ tcp_flags = 0x00;
+ }
+
+ /* We're using IP address 0.0.0.0 for a special purpose here, so don't let
+ * them spoof us. [DHCP needs this feature - HW] */
+ if (!addr.s_addr) {
+ DEBUGP("PSD: spoofed source address (0.0.0.0)\n");
+ return 0;
+ }
+
+ /* Use jiffies here not to depend on someone setting the time while we're
+ * running; we need to be careful with possible return value overflows. */
+ now = jiffies;
+
+ spin_lock(&state.lock);
+
+ /* Do we know this source address already? */
+ count = 0;
+ last = NULL;
+ if ((curr = *(head = &state.hash[hash = hashfunc(addr)])))
+ do {
+ if (curr->src_addr.s_addr == addr.s_addr) break;
+ count++;
+ if (curr->next) last = curr;
+ } while ((curr = curr->next));
+
+ if (curr) {
+
+ /* We know this address, and the entry isn't too old. Update it. */
+ if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
+ time_after_eq(now, curr->timestamp)) {
+
+ /* Just update the appropriate list entry if we've seen this port already */
+ for (index = 0; index < curr->count; index++) {
+ if (curr->ports[index].number == dest_port) {
+ curr->ports[index].proto = proto;
+ curr->ports[index].and_flags &= tcp_flags;
+ curr->ports[index].or_flags |= tcp_flags;
+ goto out_no_match;
+ }
+ }
+
+ /* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */
+ if (proto == IPPROTO_TCP && (tcp_hdr->ack || tcp_hdr->rst))
+ goto out_no_match;
+
+ /* Packet to a new port, and not TCP/ACK: update the timestamp */
+ curr->timestamp = now;
+
+ /* Logged this scan already? Then drop the packet. */
+ if (curr->weight >= psdinfo->weight_threshold)
+ goto out_match;
+
+ /* Specify if destination address, source port, TOS or TTL are not fixed */
+ if (curr->dest_addr.s_addr != ip_hdr->daddr)
+ curr->flags |= HF_DADDR_CHANGING;
+ if (curr->src_port != src_port)
+ curr->flags |= HF_SPORT_CHANGING;
+ if (curr->tos != ip_hdr->tos)
+ curr->flags |= HF_TOS_CHANGING;
+ if (curr->ttl != ip_hdr->ttl)
+ curr->flags |= HF_TTL_CHANGING;
+
+ /* Update the total weight */
+ curr->weight += (ntohs(dest_port) < 1024) ?
+ psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
+
+ /* Got enough destination ports to decide that this is a scan? */
+ /* Then log it and drop the packet. */
+ if (curr->weight >= psdinfo->weight_threshold)
+ goto out_match;
+
+ /* Remember the new port */
+ if (curr->count < SCAN_MAX_COUNT) {
+ curr->ports[curr->count].number = dest_port;
+ curr->ports[curr->count].proto = proto;
+ curr->ports[curr->count].and_flags = tcp_flags;
+ curr->ports[curr->count].or_flags = tcp_flags;
+ curr->count++;
+ }
+
+ goto out_no_match;
+ }
+
+ /* We know this address, but the entry is outdated. Mark it unused, and
+ * remove from the hash table. We'll allocate a new entry instead since
+ * this one might get re-used too soon. */
+ curr->src_addr.s_addr = 0;
+ if (last)
+ last->next = last->next->next;
+ else if (*head)
+ *head = (*head)->next;
+ last = NULL;
+ }
+
+ /* We don't need an ACK from a new source address */
+ if (proto == IPPROTO_TCP && tcp_hdr->ack)
+ goto out_no_match;
+
+ /* Got too many source addresses with the same hash value? Then remove the
+ * oldest one from the hash table, so that they can't take too much of our
+ * CPU time even with carefully chosen spoofed IP addresses. */
+ if (count >= HASH_MAX && last) last->next = NULL;
+
+ /* We're going to re-use the oldest list entry, so remove it from the hash
+ * table first (if it is really already in use, and isn't removed from the
+ * hash table already because of the HASH_MAX check above). */
+
+ /* First, find it */
+ if (state.list[state.index].src_addr.s_addr)
+ head = &state.hash[hashfunc(state.list[state.index].src_addr)];
+ else
+ head = &last;
+ last = NULL;
+ if ((curr = *head))
+ do {
+ if (curr == &state.list[state.index]) break;
+ last = curr;
+ } while ((curr = curr->next));
+
+ /* Then, remove it */
+ if (curr) {
+ if (last)
+ last->next = last->next->next;
+ else if (*head)
+ *head = (*head)->next;
+ }
+
+ /* Get our list entry */
+ curr = &state.list[state.index++];
+ if (state.index >= LIST_SIZE) state.index = 0;
+
+ /* Link it into the hash table */
+ head = &state.hash[hash];
+ curr->next = *head;
+ *head = curr;
+
+ /* And fill in the fields */
+ curr->timestamp = now;
+ curr->src_addr = addr;
+ curr->dest_addr.s_addr = ip_hdr->daddr;
+ curr->src_port = src_port;
+ curr->count = 1;
+ curr->weight = (ntohs(dest_port) < 1024) ?
+ psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
+ curr->ports[0].number = dest_port;
+ curr->ports[0].proto = proto;
+ curr->ports[0].and_flags = tcp_flags;
+ curr->ports[0].or_flags = tcp_flags;
+ curr->tos = ip_hdr->tos;
+ curr->ttl = ip_hdr->ttl;
+
+out_no_match:
+ spin_unlock(&state.lock);
+ return 0;
+
+out_match:
+ spin_unlock(&state.lock);
+ return 1;
+}
+
+static int ipt_psd_checkentry(const char *tablename,
+ const struct ipt_ip *e,
+ void *matchinfo,
+ unsigned int matchsize,
+ unsigned int hook_mask)
+{
+/* const struct ipt_psd_info *psdinfo = targinfo;*/
+
+ /* we accept TCP only */
+/* if (e->ip.proto != IPPROTO_TCP) { */
+/* DEBUGP("PSD: specified protocol may be TCP only\n"); */
+/* return 0; */
+/* } */
+
+ if (matchsize != IPT_ALIGN(sizeof(struct ipt_psd_info))) {
+ DEBUGP("PSD: matchsize %u != %u\n",
+ matchsize,
+ IPT_ALIGN(sizeof(struct ipt_psd_info)));
+ return 0;
+ }
+
+ return 1;
+}
+
+static struct ipt_match ipt_psd_reg = {
+ .name = "psd",
+ .match = ipt_psd_match,
+ .checkentry = ipt_psd_checkentry,
+ .me = THIS_MODULE };
+
+static int __init init(void)
+{
+ if (ipt_register_match(&ipt_psd_reg))
+ return -EINVAL;
+
+ memset(&state, 0, sizeof(state));
+
+ spin_lock_init(&(state.lock));
+
+ printk("netfilter PSD loaded - (c) astaro AG\n");
+ return 0;
+}
+
+static void __exit fini(void)
+{
+ ipt_unregister_match(&ipt_psd_reg);
+ printk("netfilter PSD unloaded - (c) astaro AG\n");
+}
+
+module_init(init);
+module_exit(fini);
Added: netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_quota.c
==============================================================================
--- (empty file)
+++ netfilter-2.6/patch-o-matic-ng/trunk/net/ipv4/netfilter/ipt_quota.c Thu Jul 28 11:38:24 2005
@@ -0,0 +1,96 @@
+/*
+ * netfilter module to enforce network quotas
+ *
+ * Sam Johnston <samj at samj.net>
+ *
+ * 30/01/05: Fixed on SMP --Pablo Neira <pablo at eurodev.net>
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_quota.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Sam Johnston <samj at samj.net>");
+
+static spinlock_t quota_lock = SPIN_LOCK_UNLOCKED;
+
+static int
+match(const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const void *matchinfo,
+ int offset, int *hotdrop)
+{
+ struct ipt_quota_info *q =
+ ((struct ipt_quota_info *) matchinfo)->master;
+
+ if (skb->len < sizeof(struct iphdr))
+ return NF_ACCEPT;
+
+ spin_lock_bh("a_lock);
+
+ if (q->quota >= skb->len) {
+ /* we can afford this one */
+ q->quota -= skb->len;
+ spin_unlock_bh("a_lock);
+
+#ifdef DEBUG_IPT_QUOTA
+ printk("IPT Quota OK: %llu datlen %d \n", q->quota, skb->len);
+#endif
+ return 1;
+ }
+
+ /* so we do not allow even small packets from now on */
+ q->quota = 0;
+
+#ifdef DEBUG_IPT_QUOTA
+ printk("IPT Quota Failed: %llu datlen %d \n", q->quota, skb->len);
+#endif
+
+ spin_unlock_bh("a_lock);
+ return 0;
+}
+
+static int
+checkentry(const char *tablename,
+ const struct ipt_ip *ip,
+ void *matchinfo, unsigned int matchsize, unsigned int hook_mask)
+{
+ /* TODO: spinlocks? sanity checks? */
+ struct ipt_quota_info *q = (struct ipt_quota_info *) matchinfo;
+
+ if (matchsize != IPT_ALIGN(sizeof (struct ipt_quota_info)))
+ return 0;
+
+ /* For SMP, we only want to use one set of counters. */
+ q->master = q;
+
+ return 1;
+}
+
+static struct ipt_match quota_match = {
+ .name = "quota",
+ .match = match,
+ .checkentry = checkentry,
+ .me = THIS_MODULE
+};
+
+static int __init
+init(void)
+{
+ return ipt_register_match("a_match);
+}
+
+static void __exit
+fini(void)
+{
+ ipt_unregister_match("a_match);
+}
+
+module_init(init);
+module_exit(fini);
+
Modified: netfilter-2.6/patch-o-matic-ng/trunk/status
==============================================================================
--- netfilter-2.6/patch-o-matic-ng/trunk/status (original)
+++ netfilter-2.6/patch-o-matic-ng/trunk/status Thu Jul 28 11:38:24 2005
@@ -29,8 +29,8 @@
osf 2005/07/27 added
policy 2005/07/27 added
pptp-conntrack-nat 2005/07/27 added fix build warnings
-psd added
-quota added
+psd 2005/07/27 added
+quota 2005/07/27 added
realm updated
recent updated (v0.3.2)
REJECT updated
@@ -41,8 +41,8 @@
string added
TARPIT added
time 2005/07/27 added
-TTL added
+TTL 2005/07/27 added
u32 added+updated
ULOG updated
unclean added
-XOR added
+XOR 2005/07/27 added
More information about the pld-cvs-commit
mailing list