зеркало из https://github.com/github/synsanity.git
Initial import.
This commit is contained in:
Theo Julienne
Коммит
e2e2d53a4a
|
|
@ -0,0 +1,8 @@
|
|||
*.so
|
||||
*.cmd
|
||||
*.mod
|
||||
*.mod.*
|
||||
*.ko
|
||||
*.o
|
||||
modules.order
|
||||
Module.symvers
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
# Contributor Covenant Code of Conduct
|
||||
|
||||
## Our Pledge
|
||||
|
||||
In the interest of fostering an open and welcoming environment, we as
|
||||
contributors and maintainers pledge to making participation in our project and
|
||||
our community a harassment-free experience for everyone, regardless of age, body
|
||||
size, disability, ethnicity, gender identity and expression, level of experience,
|
||||
nationality, personal appearance, race, religion, or sexual identity and
|
||||
orientation.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to creating a positive environment
|
||||
include:
|
||||
|
||||
* Using welcoming and inclusive language
|
||||
* Being respectful of differing viewpoints and experiences
|
||||
* Gracefully accepting constructive criticism
|
||||
* Focusing on what is best for the community
|
||||
* Showing empathy towards other community members
|
||||
|
||||
Examples of unacceptable behavior by participants include:
|
||||
|
||||
* The use of sexualized language or imagery and unwelcome sexual attention or
|
||||
advances
|
||||
* Trolling, insulting/derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing others' private information, such as a physical or electronic
|
||||
address, without explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a
|
||||
professional setting
|
||||
|
||||
## Our Responsibilities
|
||||
|
||||
Project maintainers are responsible for clarifying the standards of acceptable
|
||||
behavior and are expected to take appropriate and fair corrective action in
|
||||
response to any instances of unacceptable behavior.
|
||||
|
||||
Project maintainers have the right and responsibility to remove, edit, or
|
||||
reject comments, commits, code, wiki edits, issues, and other contributions
|
||||
that are not aligned to this Code of Conduct, or to ban temporarily or
|
||||
permanently any contributor for other behaviors that they deem inappropriate,
|
||||
threatening, offensive, or harmful.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies both within project spaces and in public spaces
|
||||
when an individual is representing the project or its community. Examples of
|
||||
representing a project or community include using an official project e-mail
|
||||
address, posting via an official social media account, or acting as an appointed
|
||||
representative at an online or offline event. Representation of a project may be
|
||||
further defined and clarified by project maintainers.
|
||||
|
||||
## Enforcement
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||
reported by contacting the project team at [INSERT EMAIL ADDRESS]. All
|
||||
complaints will be reviewed and investigated and will result in a response that
|
||||
is deemed necessary and appropriate to the circumstances. The project team is
|
||||
obligated to maintain confidentiality with regard to the reporter of an incident.
|
||||
Further details of specific enforcement policies may be posted separately.
|
||||
|
||||
Project maintainers who do not follow or enforce the Code of Conduct in good
|
||||
faith may face temporary or permanent repercussions as determined by other
|
||||
members of the project's leadership.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
|
||||
available at [http://contributor-covenant.org/version/1/4][version]
|
||||
|
||||
[homepage]: http://contributor-covenant.org
|
||||
[version]: http://contributor-covenant.org/version/1/4/
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
## Contributing
|
||||
|
||||
[fork]: https://github.com/github/REPO/fork
|
||||
[pr]: https://github.com/github/REPO/compare
|
||||
[code-of-conduct]: CODE_OF_CONDUCT.md
|
||||
|
||||
Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
|
||||
|
||||
Please note that this project is released with a [Contributor Code of Conduct][code-of-conduct]. By participating in this project you agree to abide by its terms.
|
||||
|
||||
## Submitting a pull request
|
||||
|
||||
0. [Fork][fork] and clone the repository
|
||||
0. Create a new branch: `git checkout -b my-branch-name`
|
||||
0. Make your change, test that your changes continue to work with the provided scripts
|
||||
0. Push to your fork and [submit a pull request][pr]
|
||||
0. Pat your self on the back and wait for your pull request to be reviewed and merged.
|
||||
|
||||
Here are a few things you can do that will increase the likelihood of your pull request being accepted:
|
||||
|
||||
- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
|
||||
- Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
|
||||
|
||||
## Resources
|
||||
|
||||
- [Contributing to Open Source on GitHub](https://guides.github.com/activities/contributing-to-open-source/)
|
||||
- [Using Pull Requests](https://help.github.com/articles/using-pull-requests/)
|
||||
- [GitHub Help](https://help.github.com)
|
||||
|
|
@ -0,0 +1,278 @@
|
|||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
Copyright (c) 2012-2016 GitHub, Inc.
|
||||
|
||||
Permission is hereby granted, free of charge, to any person
|
||||
obtaining a copy of this software and associated documentation
|
||||
files (the "Software"), to deal in the Software without
|
||||
restriction, including without limitation the rights to use,
|
||||
copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the
|
||||
Software is furnished to do so, subject to the following
|
||||
conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be
|
||||
included in all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
||||
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
||||
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
||||
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
||||
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
||||
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||||
OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
## condition match
|
||||
|
||||
The condition match resurrects the condition match module that was available in the 2.x series kernel.
|
||||
|
||||
This allows a match target that is controlled by a userspace entry in the proc filesystem. For example:
|
||||
```
|
||||
iptables -A INPUT -p tcp -m tcp --dport 80 -m condition ! --condition knockknock -j DROP
|
||||
```
|
||||
|
||||
By default, the above rule will match since the condition is default 0, and port 80 will be blocked. This can be toggled via proc:
|
||||
```
|
||||
echo 1 > /proc/net/ipt_condition/knockknock
|
||||
# packets to port 80 go through
|
||||
echo 0 > /proc/net/ipt_condition/knockknock
|
||||
# packets to port 80 are blocked again
|
||||
```
|
||||
|
||||
## CONDITION target
|
||||
|
||||
In addition to the original condition match, a CONDITION target has been added that can change the same condition values based on a certain other set of xtables matches. For example, to enable the above port 80 condition only after a packet arrives on port 42:
|
||||
```
|
||||
iptables -A INPUT -p tcp -m tcp --dport 42 -j CONDITION --condition knockknock
|
||||
```
|
||||
|
||||
This would look like the following:
|
||||
```
|
||||
echo 0 > /proc/net/ipt_condition/knockknock
|
||||
# packets to port 80 are blocked
|
||||
nc localhost 42
|
||||
# packets to port 80 are unblocked
|
||||
echo 0 > /proc/net/ipt_condition/knockknock
|
||||
# packets to port 80 are blocked again
|
||||
```
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
# synsanity
|
||||
|
||||
synsanity is a netfilter (iptables) target for high performance lockless SYN cookies for SYN flood mitigation, as used in production at GitHub.
|
||||
|
||||
synsanity allows Linux servers running 3.x kernels to handle SYN floods with minimal (or at least less) performance impact. With default Linux kernel 3.x settings, a very small SYN flood causes complete CPU exhaustion as the kernel spinlocks on the LISTEN socket and in conntrack. synsanity moves much of this work into a netfilter (iptables) target and bypasses locks for this attack scenario, allowing high throughput syncookie generation before the packets hit the TCP stack.
|
||||
|
||||
The following components make up synsanity and its supporting setup:
|
||||
* [kmod: ipt_SYNSANITY](https://github.com/github/synsanity/blob/master/kmod/ipt_SYNSANITY.c) contains the kernel-side iptables module, where most of the work happens.
|
||||
* [kmod: xt_syncookies](https://github.com/github/synsanity/blob/master/kmod/xt_syncookies.c) contains iptables match targets for whether the kernel would generate or accept syncookies for the given packet's LISTEN socket.
|
||||
* [kmod: xt_condition](https://github.com/github/synsanity/blob/master/kmod/xt_condition.c) contains a condition match target, allowing dynamic control of a set of iptables rules from the proc filesystem.
|
||||
* [iptext](https://github.com/github/synsanity/tree/master/iptext) contains the client side iptables modules to configure the above modules.
|
||||
* [scripts](https://github.com/github/synsanity/tree/master/scripts) contains scripts to set up synsanity and its appropriate iptables rules.
|
||||
|
||||
## Building
|
||||
|
||||
This release is designed to work on Ubuntu 12.04 running the `linux-image-generic-lts-trusty` kernel (3.13.x), though it should also be possible to run on Trusty itself and other systems running 3.x kernels with very little modification.
|
||||
|
||||
The following dependencies are required to build synsanity on Ubuntu systems:
|
||||
```
|
||||
sudo apt-get install build-essential pkg-config dkms linux-headers-$(uname -r) iptables-dev
|
||||
```
|
||||
|
||||
The simplest way to build and install the modules is using `dkms`:
|
||||
```
|
||||
cd .../synsanity
|
||||
dkms build .
|
||||
dkms install synsanity/0.1.2
|
||||
```
|
||||
|
||||
To build and install the iptables CLI modules:
|
||||
```
|
||||
make -C iptext install
|
||||
```
|
||||
|
||||
Then use the scripts to install the synsanity iptables rules (see Usage below for customisation instructions):
|
||||
```
|
||||
scripts/setup_synsanity
|
||||
```
|
||||
|
||||
And check the status of synsanity on a given port:
|
||||
```
|
||||
# scripts/nagios_check_synsanity_port 80
|
||||
SYNSANITY mitigation for port 80 is currently disabled. Everything is OK.
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
The scripts provided here will set up synsanity on a specific set of public ports specified. The `setup_synsanity` script includes lines like the following:
|
||||
|
||||
```
|
||||
add_synsanity_rule INPUT synsanity-mitigation-80 eth0 80
|
||||
```
|
||||
|
||||
This hooks synsanity mitigation rules in the iptables `INPUT` chain using a condition called `synsanity-mitigation-80` on packets arriving on the interface `eth0` on port `80`.
|
||||
|
||||
In this case, the condition will be available at `/proc/net/ipt_condition/synsanity-mitigation-80` and will defualt to `0`, meaning synsanity is not intercepting packets. By default, when `add_synsanity_rule` sees a watermark of 90% on the SYN receive queue on the receiving socket, it will enable this condition (and the proc file will show `1`), and thus enable synsanity's mitigation on that port.
|
||||
|
||||
The scripts provided here don't automatically disable mitigation when an attack is over, but rather a nagios check script called `nagios_check_synsanity_port` is provided which shows how to create an alert based on mitigation. Manually enabling or disabling synsanity mitigation on a port is as simple as changing the condition:
|
||||
|
||||
```
|
||||
echo 0 > /proc/net/ipt_condition/synsanity-mitigation-80 # disable mitigation on port 80
|
||||
echo 1 > /proc/net/ipt_condition/synsanity-mitigation-80 # enable mitigation on port 80
|
||||
```
|
||||
|
||||
## Contributions
|
||||
|
||||
Compatibility improvements, documentation updates and bug fixes are always welcome! Please check out our [Contributing Guidelines](CONTRIBUTING.md) and [Contributor Code of Conduct](CODE_OF_CONDUCT.md).
|
||||
|
||||
## License
|
||||
|
||||
The synsanity kernel modules and associated iptables CLI modules and build scripts are licensed under the [GPL](LICENSE.GPL) license. synsanity runtime scripts are licensed under the [MIT](LICENSE.MIT) license.
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
MAKE="make -C kmod/ KDIR=/lib/modules/${kernelver}/build"
|
||||
CLEAN="make -C kmod/ clean"
|
||||
PACKAGE_NAME=synsanity
|
||||
PACKAGE_VERSION=0.1.2
|
||||
REMAKE_INITRD=no
|
||||
|
||||
BUILT_MODULE_NAME[0]=ipt_SYNSANITY
|
||||
DEST_MODULE_LOCATION[0]="/updates"
|
||||
BUILT_MODULE_LOCATION[0]=kmod/
|
||||
|
||||
BUILT_MODULE_NAME[1]=xt_syncookies
|
||||
DEST_MODULE_LOCATION[1]="/updates"
|
||||
BUILT_MODULE_LOCATION[1]=kmod/
|
||||
|
||||
BUILT_MODULE_NAME[2]=xt_condition
|
||||
DEST_MODULE_LOCATION[2]="/updates"
|
||||
BUILT_MODULE_LOCATION[2]=kmod/
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
KSRC=/usr/src/linux-headers-$(shell uname -r)
|
||||
CFLAGS=-I$(KSRC)/include/uapi -I$(KSRC)/include -DPIC -fPIC -Wno-cpp
|
||||
LDFLAGS=-lxtables -shared
|
||||
XF_MODULE=libxt_SYNSANITY
|
||||
XT_MATCH_MODULE=libxt_syncookies
|
||||
XT_CONDITION_MODULE=libxt_condition
|
||||
XT_CONDITION_TG_MODULE=libxt_CONDITION
|
||||
|
||||
.PHONY: lib
|
||||
lib: $(XF_MODULE).so $(XT_MATCH_MODULE).so $(XT_CONDITION_MODULE).so
|
||||
|
||||
%.so: %.c
|
||||
$(CC) -o $@ $< $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
.PHONY: clean
|
||||
clean:
|
||||
rm $(XF_MODULE).so $(XT_MATCH_MODULE).so $(XT_CONDITION_MODULE).so
|
||||
|
||||
.PHONY: install
|
||||
install: lib
|
||||
install -d $(DESTDIR)$(shell pkg-config --variable=xtlibdir xtables)
|
||||
install -m 0755 $(XF_MODULE).so $(DESTDIR)$(shell pkg-config --variable=xtlibdir xtables)
|
||||
install -m 0755 $(XT_MATCH_MODULE).so $(DESTDIR)$(shell pkg-config --variable=xtlibdir xtables)
|
||||
install -m 0755 $(XT_CONDITION_MODULE).so $(DESTDIR)$(shell pkg-config --variable=xtlibdir xtables)
|
||||
install -m 0755 $(XT_CONDITION_MODULE).so $(DESTDIR)$(shell pkg-config --variable=xtlibdir xtables)/$(XT_CONDITION_TG_MODULE).so
|
||||
|
|
@ -0,0 +1,132 @@
|
|||
/*
|
||||
* Original SYNPROXY code copyright (c) 2013 Patrick McHardy <kaber@trash.net>
|
||||
* SYNSANITY modifications copyright (c) 2015 Theo Julienne <theo@github.com>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#include <stdbool.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// hacks for precise, because the system linux/asm includes don't match the trusty kernel
|
||||
#define _ASM_X86_POSIX_TYPES_64_H
|
||||
#include "asm-generic/posix_types.h"
|
||||
|
||||
#include <xtables.h>
|
||||
#include <linux/netfilter/xt_SYNPROXY.h>
|
||||
|
||||
enum {
|
||||
O_SACK_PERM = 0,
|
||||
O_TIMESTAMP,
|
||||
O_WSCALE,
|
||||
O_MSS,
|
||||
O_ECN,
|
||||
};
|
||||
|
||||
static void SYNSANITY_help(void)
|
||||
{
|
||||
printf(
|
||||
"SYNSANITY target options:\n"
|
||||
" --sack-perm Set SACK_PERM\n"
|
||||
" --timestamp Set TIMESTAMP\n"
|
||||
" --wscale value Set window scaling factor\n"
|
||||
" --mss value Set MSS value\n"
|
||||
" --ecn Set ECN\n");
|
||||
}
|
||||
|
||||
static const struct xt_option_entry SYNSANITY_opts[] = {
|
||||
{.name = "sack-perm", .id = O_SACK_PERM, .type = XTTYPE_NONE, },
|
||||
{.name = "timestamp", .id = O_TIMESTAMP, .type = XTTYPE_NONE, },
|
||||
{.name = "wscale", .id = O_WSCALE, .type = XTTYPE_UINT32, },
|
||||
{.name = "mss", .id = O_MSS, .type = XTTYPE_UINT32, },
|
||||
{.name = "ecn", .id = O_ECN, .type = XTTYPE_NONE, },
|
||||
XTOPT_TABLEEND,
|
||||
};
|
||||
|
||||
static void SYNSANITY_parse(struct xt_option_call *cb)
|
||||
{
|
||||
struct xt_synproxy_info *info = cb->data;
|
||||
|
||||
xtables_option_parse(cb);
|
||||
switch (cb->entry->id) {
|
||||
case O_SACK_PERM:
|
||||
info->options |= XT_SYNPROXY_OPT_SACK_PERM;
|
||||
break;
|
||||
case O_TIMESTAMP:
|
||||
info->options |= XT_SYNPROXY_OPT_TIMESTAMP;
|
||||
break;
|
||||
case O_WSCALE:
|
||||
info->options |= XT_SYNPROXY_OPT_WSCALE;
|
||||
info->wscale = cb->val.u32;
|
||||
break;
|
||||
case O_MSS:
|
||||
info->options |= XT_SYNPROXY_OPT_MSS;
|
||||
info->mss = cb->val.u32;
|
||||
break;
|
||||
case O_ECN:
|
||||
info->options |= XT_SYNPROXY_OPT_ECN;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
static void SYNSANITY_check(struct xt_fcheck_call *cb)
|
||||
{
|
||||
}
|
||||
|
||||
static void SYNSANITY_print(const void *ip, const struct xt_entry_target *target,
|
||||
int numeric)
|
||||
{
|
||||
const struct xt_synproxy_info *info =
|
||||
(const struct xt_synproxy_info *)target->data;
|
||||
|
||||
printf(" SYNSANITY ");
|
||||
if (info->options & XT_SYNPROXY_OPT_SACK_PERM)
|
||||
printf("sack-perm ");
|
||||
if (info->options & XT_SYNPROXY_OPT_TIMESTAMP)
|
||||
printf("timestamp ");
|
||||
if (info->options & XT_SYNPROXY_OPT_WSCALE)
|
||||
printf("wscale %u ", info->wscale);
|
||||
if (info->options & XT_SYNPROXY_OPT_MSS)
|
||||
printf("mss %u ", info->mss);
|
||||
if (info->options & XT_SYNPROXY_OPT_ECN)
|
||||
printf("ecn ");
|
||||
}
|
||||
|
||||
static void SYNSANITY_save(const void *ip, const struct xt_entry_target *target)
|
||||
{
|
||||
const struct xt_synproxy_info *info =
|
||||
(const struct xt_synproxy_info *)target->data;
|
||||
|
||||
if (info->options & XT_SYNPROXY_OPT_SACK_PERM)
|
||||
printf(" --sack-perm");
|
||||
if (info->options & XT_SYNPROXY_OPT_TIMESTAMP)
|
||||
printf(" --timestamp");
|
||||
if (info->options & XT_SYNPROXY_OPT_WSCALE)
|
||||
printf(" --wscale %u", info->wscale);
|
||||
if (info->options & XT_SYNPROXY_OPT_MSS)
|
||||
printf(" --mss %u", info->mss);
|
||||
if (info->options & XT_SYNPROXY_OPT_ECN)
|
||||
printf(" --ecn");
|
||||
}
|
||||
|
||||
static struct xtables_target synsanity_tg_reg = {
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.name = "SYNSANITY",
|
||||
.version = XTABLES_VERSION,
|
||||
.revision = 0,
|
||||
.size = XT_ALIGN(sizeof(struct xt_synproxy_info)),
|
||||
.userspacesize = XT_ALIGN(sizeof(struct xt_synproxy_info)),
|
||||
.help = SYNSANITY_help,
|
||||
.print = SYNSANITY_print,
|
||||
.save = SYNSANITY_save,
|
||||
.x6_parse = SYNSANITY_parse,
|
||||
.x6_fcheck = SYNSANITY_check,
|
||||
.x6_options = SYNSANITY_opts,
|
||||
};
|
||||
|
||||
void _init(void)
|
||||
{
|
||||
xtables_register_target(&synsanity_tg_reg);
|
||||
}
|
||||
|
|
@ -0,0 +1,145 @@
|
|||
/*
|
||||
* libxt_condition
|
||||
* Shared library add-on to iptables for userspace condition match.
|
||||
*
|
||||
* Copyright (c) Theo Julienne <theo@github.com>
|
||||
*
|
||||
* Based on original libipt_condition:
|
||||
* Copyright (c) Stephane Ouellette <ouellettes@videotron.ca>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
// hacks for precise, because the system linux/asm includes don't match the trusty kernel
|
||||
#define _ASM_X86_POSIX_TYPES_64_H
|
||||
#include "asm-generic/posix_types.h"
|
||||
|
||||
#include <xtables.h>
|
||||
|
||||
#include "../kmod/xt_condition.h"
|
||||
|
||||
/** condition match **/
|
||||
|
||||
static void condition_help(void)
|
||||
{
|
||||
printf(
|
||||
"condition match options:\n"
|
||||
" [!] --condition filename\n"
|
||||
" Match on boolean value stored in /proc file\n");
|
||||
}
|
||||
|
||||
enum {
|
||||
O_CONDITION = 0,
|
||||
};
|
||||
|
||||
static const struct xt_option_entry condition_opts[] = {
|
||||
{
|
||||
.name = "condition",
|
||||
.id = O_CONDITION,
|
||||
.type = XTTYPE_STRING,
|
||||
.flags = XTOPT_INVERT | XTOPT_PUT,
|
||||
XTOPT_POINTER(struct condition_info, name)
|
||||
},
|
||||
XTOPT_TABLEEND,
|
||||
};
|
||||
|
||||
static void condition_parse(struct xt_option_call *cb)
|
||||
{
|
||||
struct condition_info *sinfo = cb->data;
|
||||
|
||||
xtables_option_parse(cb);
|
||||
sinfo->invert = cb->invert;
|
||||
}
|
||||
|
||||
static void condition_print(const void *ip, const struct xt_entry_match *match,
|
||||
int numeric)
|
||||
{
|
||||
const struct condition_info *info =
|
||||
(const struct condition_info *) match->data;
|
||||
|
||||
printf("%s condition %s", (info->invert) ? " !" : "", info->name);
|
||||
}
|
||||
|
||||
|
||||
static void condition_save(const void *ip, const struct xt_entry_match *match)
|
||||
{
|
||||
const struct condition_info *info =
|
||||
(const struct condition_info *) match->data;
|
||||
|
||||
printf("%s --condition \"%s\"", (info->invert) ? " !" : "", info->name);
|
||||
}
|
||||
|
||||
static struct xtables_match condition_mt_reg = {
|
||||
.name = "condition",
|
||||
.version = XTABLES_VERSION,
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.size = XT_ALIGN(sizeof(struct condition_info)),
|
||||
.userspacesize = offsetof(struct condition_info, var),
|
||||
.help = condition_help,
|
||||
.print = condition_print,
|
||||
.save = condition_save,
|
||||
.x6_parse = condition_parse,
|
||||
.x6_options = condition_opts,
|
||||
};
|
||||
|
||||
/** CONDITION target **/
|
||||
|
||||
static void CONDITION_help(void)
|
||||
{
|
||||
printf(
|
||||
"CONDITION target options:\n"
|
||||
" [!] --condition filename Set (or unset if inverted) condition variable\n");
|
||||
}
|
||||
|
||||
static void CONDITION_check(struct xt_fcheck_call *cb)
|
||||
{
|
||||
}
|
||||
|
||||
static void CONDITION_print(const void *ip, const struct xt_entry_target *target,
|
||||
int numeric)
|
||||
{
|
||||
const struct condition_info *info =
|
||||
(const struct condition_info *)target->data;
|
||||
|
||||
printf(" CONDITION ");
|
||||
if (info->invert)
|
||||
printf("! ");
|
||||
printf("%s", info->name);
|
||||
}
|
||||
|
||||
static void CONDITION_save(const void *ip, const struct xt_entry_target *target)
|
||||
{
|
||||
const struct condition_info *info =
|
||||
(const struct condition_info *)target->data;
|
||||
|
||||
if (info->invert)
|
||||
printf(" !");
|
||||
printf(" --condition \"%s\"", info->name);
|
||||
}
|
||||
|
||||
static struct xtables_target condition_tg_reg = {
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.name = "CONDITION",
|
||||
.version = XTABLES_VERSION,
|
||||
.revision = 0,
|
||||
.size = XT_ALIGN(sizeof(struct condition_info)),
|
||||
.userspacesize = offsetof(struct condition_info, var),
|
||||
.help = CONDITION_help,
|
||||
.print = CONDITION_print,
|
||||
.save = CONDITION_save,
|
||||
.x6_parse = condition_parse,
|
||||
.x6_fcheck = CONDITION_check,
|
||||
.x6_options = condition_opts,
|
||||
};
|
||||
|
||||
void
|
||||
_init(void)
|
||||
{
|
||||
xtables_register_matches(&condition_mt_reg, 1);
|
||||
xtables_register_targets(&condition_tg_reg, 1);
|
||||
}
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
/*
|
||||
* libxt_syncookies
|
||||
* Shared library add-on to iptables for syncookies matching support.
|
||||
*
|
||||
* Copyright (c) Theo Julienne <theo@github.com>
|
||||
*
|
||||
* Based on snippets from libxt_conntrack.c:
|
||||
* GPL (C) 2001 Marc Boucher (marc@mbsi.ca).
|
||||
* Copyright © CC Computer Consultants GmbH, 2007 - 2008
|
||||
* Jan Engelhardt <jengelh@computergmbh.de>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
#include <stdbool.h>
|
||||
#include <stdio.h>
|
||||
|
||||
// hacks for precise, because the system linux/asm includes don't match the trusty kernel
|
||||
#define _ASM_X86_POSIX_TYPES_64_H
|
||||
#include "asm-generic/posix_types.h"
|
||||
|
||||
#include <xtables.h>
|
||||
#include "../kmod/xt_syncookies.h"
|
||||
|
||||
static void
|
||||
syncookies_help(void)
|
||||
{
|
||||
printf(
|
||||
"syncookies match options:\n"
|
||||
" [!] --syncookies-accepted\n"
|
||||
" Match if syncookies would be accepted\n"
|
||||
" [!] --syncookies-would-send\n"
|
||||
" Match if syncookies would be sent\n"
|
||||
" [!] --syn-queue-level percentage\n"
|
||||
" Match if SYN queue for this socket is over percentage (0-100)\n"
|
||||
);
|
||||
}
|
||||
|
||||
static const struct xt_option_entry syncookies_opts[] = {
|
||||
{.name = "syncookies-accepted", .id = O_XT_SYNCOOKIES_ACCEPTED, .type = XTTYPE_NONE,
|
||||
.flags = XTOPT_INVERT},
|
||||
{.name = "syncookies-would-send", .id = O_XT_SYNCOOKIES_SENT, .type = XTTYPE_NONE,
|
||||
.flags = XTOPT_INVERT},
|
||||
{.name = "syn-queue-level", .id = O_XT_SYNCOOKIES_LEVEL, .type = XTTYPE_UINT8, .min = 0, .max = 100,
|
||||
.flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(struct xt_syncookies_info, queue_level_percent)},
|
||||
XTOPT_TABLEEND,
|
||||
};
|
||||
|
||||
static void syncookies_parse(struct xt_option_call *cb)
|
||||
{
|
||||
struct xt_syncookies_info *sinfo = cb->data;
|
||||
|
||||
xtables_option_parse(cb);
|
||||
sinfo->mode = cb->entry->id;
|
||||
sinfo->invert = cb->invert;
|
||||
}
|
||||
|
||||
static void
|
||||
syncookies_print(const void *ip,
|
||||
const struct xt_entry_match *match,
|
||||
int numeric)
|
||||
{
|
||||
const struct xt_syncookies_info *sinfo = (const void *)match->data;
|
||||
|
||||
if (sinfo->invert)
|
||||
printf(" !");
|
||||
if (sinfo->mode == O_XT_SYNCOOKIES_SENT)
|
||||
printf(" syncookies-would-send");
|
||||
else if (sinfo->mode == O_XT_SYNCOOKIES_ACCEPTED)
|
||||
printf(" syncookies-accepted");
|
||||
else if (sinfo->mode == O_XT_SYNCOOKIES_LEVEL)
|
||||
printf(" syn-queue-level %d", sinfo->queue_level_percent);
|
||||
}
|
||||
|
||||
static void syncookies_save(const void *ip, const struct xt_entry_match *match)
|
||||
{
|
||||
const struct xt_syncookies_info *sinfo = (const void *)match->data;
|
||||
|
||||
if (sinfo->invert)
|
||||
printf(" !");
|
||||
|
||||
if (sinfo->mode == O_XT_SYNCOOKIES_SENT)
|
||||
printf(" --syncookies-would-send");
|
||||
else if (sinfo->mode == O_XT_SYNCOOKIES_ACCEPTED)
|
||||
printf(" --syncookies-accepted");
|
||||
else if (sinfo->mode == O_XT_SYNCOOKIES_LEVEL)
|
||||
printf(" --syn-queue-level %d", sinfo->queue_level_percent);
|
||||
}
|
||||
|
||||
static struct xtables_match syncookies_mt_reg[] = {
|
||||
{
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.name = "syncookies",
|
||||
.revision = 0,
|
||||
.version = XTABLES_VERSION,
|
||||
.size = XT_ALIGN(sizeof(struct xt_syncookies_info)),
|
||||
.userspacesize = XT_ALIGN(sizeof(struct xt_syncookies_info)),
|
||||
.help = syncookies_help,
|
||||
.print = syncookies_print,
|
||||
.save = syncookies_save,
|
||||
.x6_parse = syncookies_parse,
|
||||
.x6_options = syncookies_opts,
|
||||
},
|
||||
};
|
||||
|
||||
void _init(void)
|
||||
{
|
||||
xtables_register_matches(syncookies_mt_reg, 1);
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
KDIR?=/usr/src/linux-headers-$(shell uname -r)
|
||||
ROOT_DIR:=$(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
|
||||
|
||||
obj-m += ipt_SYNSANITY.o xt_syncookies.o xt_condition.o
|
||||
|
||||
all:
|
||||
$(BUILD_VARS) make -C $(KDIR) M=$(ROOT_DIR) modules
|
||||
|
||||
clean:
|
||||
$(BUILD_VARS) make -C $(KDIR) M=$(ROOT_DIR) clean
|
||||
|
|
@ -0,0 +1,359 @@
|
|||
/*
|
||||
* Original SYNPROXY code copyright (c) 2013 Patrick McHardy <kaber@trash.net>
|
||||
* SYNSANITY modifications copyright (c) 2015 Theo Julienne <theo@github.com>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#include <linux/module.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <net/tcp.h>
|
||||
|
||||
#include <linux/netfilter_ipv4/ip_tables.h>
|
||||
#include <linux/netfilter/x_tables.h>
|
||||
#include <linux/netfilter/xt_SYNPROXY.h>
|
||||
#include <net/netfilter/nf_conntrack.h>
|
||||
#include <net/netfilter/nf_conntrack_core.h>
|
||||
#include <net/netfilter/nf_conntrack_zones.h>
|
||||
#include <net/netfilter/nf_conntrack_extend.h>
|
||||
#include <net/netfilter/nf_conntrack_synproxy.h>
|
||||
|
||||
static struct iphdr *
|
||||
synsanity_build_ip(struct sk_buff *skb, u32 saddr, u32 daddr)
|
||||
{
|
||||
struct iphdr *iph;
|
||||
|
||||
skb_reset_network_header(skb);
|
||||
iph = (struct iphdr *)skb_put(skb, sizeof(*iph));
|
||||
iph->version = 4;
|
||||
iph->ihl = sizeof(*iph) / 4;
|
||||
iph->tos = 0;
|
||||
iph->id = 0;
|
||||
iph->frag_off = htons(IP_DF);
|
||||
iph->ttl = sysctl_ip_default_ttl;
|
||||
iph->protocol = IPPROTO_TCP;
|
||||
iph->check = 0;
|
||||
iph->saddr = saddr;
|
||||
iph->daddr = daddr;
|
||||
|
||||
return iph;
|
||||
}
|
||||
|
||||
static void
|
||||
synsanity_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb,
|
||||
struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
|
||||
struct iphdr *niph, struct tcphdr *nth,
|
||||
unsigned int tcp_hdr_size)
|
||||
{
|
||||
nth->check = ~tcp_v4_check(tcp_hdr_size, niph->saddr, niph->daddr, 0);
|
||||
nskb->ip_summed = CHECKSUM_PARTIAL;
|
||||
nskb->csum_start = (unsigned char *)nth - nskb->head;
|
||||
nskb->csum_offset = offsetof(struct tcphdr, check);
|
||||
|
||||
skb_dst_set_noref(nskb, skb_dst(skb));
|
||||
nskb->protocol = htons(ETH_P_IP);
|
||||
if (ip_route_me_harder(nskb, RTN_UNSPEC))
|
||||
goto free_nskb;
|
||||
|
||||
if (nfct) {
|
||||
nskb->nfct = nfct;
|
||||
nskb->nfctinfo = ctinfo;
|
||||
nf_conntrack_get(nfct);
|
||||
}
|
||||
|
||||
ip_local_out(nskb);
|
||||
return;
|
||||
|
||||
free_nskb:
|
||||
kfree_skb(nskb);
|
||||
}
|
||||
|
||||
static void
|
||||
synsanity_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
|
||||
const struct synproxy_options *opts, struct sock *listen_sk)
|
||||
{
|
||||
struct sk_buff *nskb;
|
||||
struct iphdr *iph, *niph;
|
||||
struct tcphdr *nth;
|
||||
unsigned int tcp_hdr_size;
|
||||
u16 mss = opts->mss;
|
||||
|
||||
iph = ip_hdr(skb);
|
||||
|
||||
tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
|
||||
nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
|
||||
GFP_ATOMIC);
|
||||
if (nskb == NULL)
|
||||
return;
|
||||
skb_reserve(nskb, MAX_TCP_HEADER);
|
||||
|
||||
niph = synsanity_build_ip(nskb, iph->daddr, iph->saddr);
|
||||
|
||||
skb_reset_transport_header(nskb);
|
||||
nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
|
||||
nth->source = th->dest;
|
||||
nth->dest = th->source;
|
||||
nth->seq = htonl(__cookie_v4_init_sequence(iph, th, &mss));
|
||||
nth->ack_seq = htonl(ntohl(th->seq) + 1);
|
||||
tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
|
||||
if (opts->options & XT_SYNPROXY_OPT_ECN)
|
||||
tcp_flag_word(nth) |= TCP_FLAG_ECE;
|
||||
nth->doff = tcp_hdr_size / 4;
|
||||
nth->window = htons(min((u32)th->window, 65535U));
|
||||
nth->check = 0;
|
||||
nth->urg_ptr = 0;
|
||||
|
||||
/* Match the stats and overflow marking performed by the core tcp stack.
|
||||
* This must be done without a lock. We write to the timestamp field even
|
||||
* though we don't hold a lock, which shouldn't be an issue since it's not
|
||||
* used on the LISTEN socket by anything else, and it's just an integer.
|
||||
* The stats call is per-cpu and so is safe to call outside a lock.
|
||||
*/
|
||||
{
|
||||
struct net *net = dev_net(skb_dst(skb)->dev);
|
||||
NET_INC_STATS_BH(net, LINUX_MIB_SYNCOOKIESSENT);
|
||||
|
||||
if (listen_sk)
|
||||
tcp_synq_overflow(listen_sk);
|
||||
}
|
||||
|
||||
synproxy_build_options(nth, opts);
|
||||
|
||||
synsanity_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
|
||||
niph, nth, tcp_hdr_size);
|
||||
}
|
||||
|
||||
/* Cleans up a connection matching the provided skb from conntrack.
|
||||
* This is used for TIME_WAIT assassination to keep conntrack in sync.
|
||||
* Based on: http://lxr.free-electrons.com/source/net/netfilter/nf_conntrack_netlink.c#L1081
|
||||
*/
|
||||
static void
|
||||
synsanity_nf_ct_delete_from_skb(struct sk_buff *skb)
|
||||
{
|
||||
const struct nf_conntrack_tuple_hash *thash;
|
||||
struct nf_conntrack_tuple tuple;
|
||||
struct nf_conn *ct;
|
||||
|
||||
if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), NFPROTO_IPV4, &tuple))
|
||||
return;
|
||||
|
||||
thash = nf_conntrack_find_get(dev_net(skb->dev), NF_CT_DEFAULT_ZONE, &tuple);
|
||||
if (!thash)
|
||||
return;
|
||||
|
||||
ct = nf_ct_tuplehash_to_ctrack(thash);
|
||||
|
||||
if (del_timer(&ct->timeout))
|
||||
nf_ct_delete(ct, 0, 0);
|
||||
|
||||
nf_ct_put(ct);
|
||||
}
|
||||
|
||||
#define TSBITS 6
|
||||
#define TSMASK (((__u32)1 << TSBITS) - 1)
|
||||
|
||||
static unsigned int
|
||||
synsanity_tg4(struct sk_buff *skb, const struct xt_action_param *par)
|
||||
{
|
||||
const struct xt_synproxy_info *info = par->targinfo;
|
||||
struct synproxy_net *snet = synproxy_pernet(dev_net(par->in));
|
||||
struct synproxy_options opts = {};
|
||||
struct tcphdr *th, _th;
|
||||
struct sock *listen_sk;
|
||||
struct net *net = dev_net(skb_dst(skb)->dev);
|
||||
struct iphdr *iph;
|
||||
unsigned int action = XT_CONTINUE;
|
||||
|
||||
/* If syncookies are globally disabled, let packets through immediately.
|
||||
* SYNSANITY won't work without syncookies enabled anyway.
|
||||
*/
|
||||
if (sysctl_tcp_syncookies == 0)
|
||||
return XT_CONTINUE;
|
||||
|
||||
if (nf_ip_checksum(skb, par->hooknum, par->thoff, IPPROTO_TCP))
|
||||
return NF_DROP;
|
||||
|
||||
th = skb_header_pointer(skb, par->thoff, sizeof(_th), &_th);
|
||||
if (th == NULL)
|
||||
return NF_DROP;
|
||||
|
||||
if (!synproxy_parse_options(skb, par->thoff, th, &opts))
|
||||
return NF_DROP;
|
||||
|
||||
iph = ip_hdr(skb);
|
||||
if (iph == NULL)
|
||||
return NF_DROP;
|
||||
|
||||
/* We only want SYN and ACK by themselves */
|
||||
if (th->fin || th->rst || (th->syn && th->ack))
|
||||
return XT_CONTINUE;
|
||||
|
||||
/* Find a LISTEN socket for this packet, if available. */
|
||||
listen_sk = inet_lookup_listener(net, &tcp_hashinfo,
|
||||
iph->saddr, th->source,
|
||||
iph->daddr, th->dest, inet_iif(skb));
|
||||
|
||||
if (th->syn) {
|
||||
/* Initial SYN from client */
|
||||
this_cpu_inc(snet->stats->syn_received);
|
||||
|
||||
/* Check for SYNs received while an existing socket with the same tuple
|
||||
* is in TIME_WAIT state. This is commonly called "TIME_WAIT assassination",
|
||||
* and is implemented in the kernel by default. However, the core TCP stack
|
||||
* cannot tell the difference between a new syncookie ACK and any other ACK,
|
||||
* so we need to perform this cleanup ourselves on the SYN itself.
|
||||
* Thankfully, this doesn't seem to require any locking.
|
||||
*/
|
||||
{
|
||||
struct sock *nsk;
|
||||
|
||||
nsk = inet_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
|
||||
iph->saddr, th->source,
|
||||
iph->daddr, th->dest,
|
||||
inet_iif(skb));
|
||||
|
||||
if (nsk) {
|
||||
if (nsk->sk_state == TCP_TIME_WAIT) {
|
||||
// from tcp_ipv4.c: check if the SYN is a valid reuse
|
||||
if (tcp_timewait_state_process(inet_twsk(nsk), skb, th) == TCP_TW_SYN) {
|
||||
// if it is, complete the old socket to prep for the new one
|
||||
inet_twsk_deschedule(inet_twsk(nsk), &tcp_death_row);
|
||||
|
||||
// also update conntrack entry, if available
|
||||
synsanity_nf_ct_delete_from_skb(skb);
|
||||
}
|
||||
inet_twsk_put(inet_twsk(nsk));
|
||||
} else {
|
||||
sock_put(nsk);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (th->ece && th->cwr)
|
||||
opts.options |= XT_SYNPROXY_OPT_ECN;
|
||||
|
||||
opts.options &= info->options;
|
||||
if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP) {
|
||||
synproxy_init_timestamp_cookie(info, &opts);
|
||||
|
||||
/* since this was reimplemented in SYNPROXY and not quite the same,
|
||||
* lets now re-adjust the timestamp to be compatible with the ones
|
||||
* generated by core linux. primarily, the always-increasing check.
|
||||
* see: cookie_init_timestamp@syncookies.c
|
||||
*/
|
||||
{
|
||||
u32 ts_now = tcp_time_stamp;
|
||||
u32 options = opts.tsval & TSMASK;
|
||||
opts.tsval = ts_now & ~TSMASK;
|
||||
opts.tsval |= options;
|
||||
if (opts.tsval > ts_now) {
|
||||
opts.tsval >>= TSBITS;
|
||||
opts.tsval--;
|
||||
opts.tsval <<= TSBITS;
|
||||
opts.tsval |= options;
|
||||
}
|
||||
}
|
||||
} else
|
||||
opts.options &= ~(XT_SYNPROXY_OPT_WSCALE |
|
||||
XT_SYNPROXY_OPT_SACK_PERM |
|
||||
XT_SYNPROXY_OPT_ECN);
|
||||
|
||||
synsanity_send_client_synack(skb, tcp_hdr(skb), &opts, listen_sk);
|
||||
|
||||
action = NF_DROP;
|
||||
goto cleanup;
|
||||
} else if (th->ack) {
|
||||
/* ACK from client */
|
||||
int mss;
|
||||
|
||||
/* If we have a LISTEN socket, check if SYN cookies are valid right now.
|
||||
* When they are valid, pre-validate, and when they aren't, let them through.
|
||||
* Note that ACKs generated by non-syncookie code will never get here since
|
||||
* conntrack will recognise them as part of an ESTABLISHED connection.
|
||||
*/
|
||||
if (listen_sk) {
|
||||
bool want_cookie = (sysctl_tcp_syncookies == 2 ||
|
||||
!tcp_synq_no_recent_overflow(listen_sk));
|
||||
|
||||
if (!want_cookie) {
|
||||
action = XT_CONTINUE;
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
|
||||
/* We pre-validate the cookie in netfilter to avoid making ACK floods lock
|
||||
* in the kernel. Note that only the initial ACK that is not part of a
|
||||
* connection will be sent here by the iptables rules.
|
||||
*/
|
||||
mss = __cookie_v4_check(ip_hdr(skb), th, ntohl(th->ack_seq) - 1);
|
||||
if (mss == 0) {
|
||||
NET_INC_STATS_BH(dev_net(skb_dst(skb)->dev), LINUX_MIB_SYNCOOKIESFAILED);
|
||||
action = NF_DROP;
|
||||
} else {
|
||||
action = XT_CONTINUE; // handled by the kernel syncookie code
|
||||
}
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
action = XT_CONTINUE;
|
||||
|
||||
cleanup:
|
||||
if (listen_sk)
|
||||
sock_put(listen_sk);
|
||||
|
||||
return action;
|
||||
}
|
||||
|
||||
static int synsanity_tg4_check(const struct xt_tgchk_param *par)
|
||||
{
|
||||
const struct ipt_entry *e = par->entryinfo;
|
||||
|
||||
if (e->ip.proto != IPPROTO_TCP ||
|
||||
e->ip.invflags & XT_INV_PROTO)
|
||||
return -EINVAL;
|
||||
|
||||
return nf_ct_l3proto_try_module_get(par->family);
|
||||
}
|
||||
|
||||
static void synsanity_tg4_destroy(const struct xt_tgdtor_param *par)
|
||||
{
|
||||
nf_ct_l3proto_module_put(par->family);
|
||||
}
|
||||
|
||||
static struct xt_target synsanity_tg4_reg __read_mostly = {
|
||||
.name = "SYNSANITY",
|
||||
.family = NFPROTO_IPV4,
|
||||
.hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
|
||||
.target = synsanity_tg4,
|
||||
.targetsize = sizeof(struct xt_synproxy_info),
|
||||
.checkentry = synsanity_tg4_check,
|
||||
.destroy = synsanity_tg4_destroy,
|
||||
.me = THIS_MODULE,
|
||||
};
|
||||
|
||||
static int __init synsanity_tg4_init(void)
|
||||
{
|
||||
int err;
|
||||
|
||||
err = xt_register_target(&synsanity_tg4_reg);
|
||||
if (err < 0)
|
||||
goto err1;
|
||||
|
||||
return 0;
|
||||
|
||||
err1:
|
||||
return err;
|
||||
}
|
||||
|
||||
static void __exit synsanity_tg4_exit(void)
|
||||
{
|
||||
xt_unregister_target(&synsanity_tg4_reg);
|
||||
}
|
||||
|
||||
module_init(synsanity_tg4_init);
|
||||
module_exit(synsanity_tg4_exit);
|
||||
|
||||
MODULE_LICENSE("GPL");
|
||||
MODULE_AUTHOR("Theo Julienne <theo@github.com>");
|
||||
|
|
@ -0,0 +1,343 @@
|
|||
/*
|
||||
* xt_condition
|
||||
* iptables kernel module for userspace condition match.
|
||||
*
|
||||
* Copyright (c) Theo Julienne <theo@github.com>
|
||||
*
|
||||
* Based on original ipt_condition:
|
||||
* Copyright (c) Stephane Ouellette <ouellettes@videotron.ca>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#include <linux/module.h>
|
||||
#include <linux/proc_fs.h>
|
||||
#include <linux/spinlock.h>
|
||||
#include <linux/string.h>
|
||||
#include <asm/atomic.h>
|
||||
#include <linux/netfilter_ipv4/ip_tables.h>
|
||||
#include "xt_condition.h"
|
||||
|
||||
|
||||
#ifndef CONFIG_PROC_FS
|
||||
#error "Proc file system support is required for this module"
|
||||
#endif
|
||||
|
||||
|
||||
MODULE_AUTHOR("Theo Julienne <theo@github.com>");
|
||||
MODULE_DESCRIPTION("Allows rules to match against condition variables");
|
||||
MODULE_LICENSE("GPL");
|
||||
|
||||
|
||||
struct condition_variable {
|
||||
struct condition_variable *next;
|
||||
struct proc_dir_entry *status_proc;
|
||||
char name[CONDITION_NAME_LEN];
|
||||
atomic_t refcount;
|
||||
int enabled;
|
||||
};
|
||||
|
||||
|
||||
static rwlock_t list_lock;
|
||||
static struct condition_variable *head = NULL;
|
||||
static struct proc_dir_entry *proc_net_condition = NULL;
|
||||
|
||||
|
||||
static int
|
||||
xt_condition_procfs_open(struct inode *inode, struct file *file)
|
||||
{
|
||||
if (!try_module_get(THIS_MODULE))
|
||||
return -EPERM; /* Not an ideal error, but better than failing later */
|
||||
file->private_data = PDE_DATA(inode);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
xt_condition_procfs_close(struct inode *inode, struct file *file)
|
||||
{
|
||||
module_put(THIS_MODULE);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static ssize_t
|
||||
xt_condition_read_info(struct file *file, char *buffer,
|
||||
size_t length, loff_t *offset)
|
||||
{
|
||||
struct condition_variable *var =
|
||||
(struct condition_variable *)file->private_data;
|
||||
|
||||
if (*offset == 0 && length >= 2) {
|
||||
char tmp[2] = {
|
||||
(var->enabled) ? '1' : '0',
|
||||
'\n'
|
||||
};
|
||||
if (copy_to_user(buffer, tmp, 2))
|
||||
return -EFAULT;
|
||||
*offset += 2;
|
||||
return 2;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static ssize_t
|
||||
xt_condition_write_info(struct file *file, const char *buffer,
|
||||
size_t length, loff_t *off)
|
||||
{
|
||||
struct condition_variable *var =
|
||||
(struct condition_variable *)file->private_data;
|
||||
|
||||
if (length >= 1) {
|
||||
char tmp[2];
|
||||
|
||||
if (copy_from_user(tmp, buffer, 1)) {
|
||||
return -EFAULT;
|
||||
}
|
||||
|
||||
/* Match only on the first character */
|
||||
switch (tmp[0]) {
|
||||
case '0':
|
||||
var->enabled = 0;
|
||||
break;
|
||||
case '1':
|
||||
var->enabled = 1;
|
||||
}
|
||||
|
||||
return length; /* say we consumed all the data */
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static bool
|
||||
xt_condition_match(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
{
|
||||
const struct condition_info *info =
|
||||
(const struct condition_info *)par->matchinfo;
|
||||
struct condition_variable *var = info->var;
|
||||
|
||||
WARN_ON(var == NULL);
|
||||
|
||||
if (var == NULL)
|
||||
return info->invert;
|
||||
|
||||
return var->enabled ^ info->invert;
|
||||
}
|
||||
|
||||
static const struct file_operations proc_fops = {
|
||||
.owner = THIS_MODULE,
|
||||
.open = xt_condition_procfs_open,
|
||||
.read = xt_condition_read_info,
|
||||
.write = xt_condition_write_info,
|
||||
.release = xt_condition_procfs_close,
|
||||
};
|
||||
|
||||
static int
|
||||
_xt_condition_safe_get_or_create(struct condition_info *info)
|
||||
{
|
||||
struct condition_variable *var, *newvar;
|
||||
char proc_name[CONDITION_NAME_LEN] = "";
|
||||
|
||||
/* Ensure input string null terminated */
|
||||
strncpy(proc_name, info->name, CONDITION_NAME_LEN);
|
||||
proc_name[CONDITION_NAME_LEN-1] = '\0';
|
||||
|
||||
info->var = NULL;
|
||||
|
||||
/* The first step is to check if the condition variable already exists. */
|
||||
/* Here, a read lock is sufficient because we won't change the list */
|
||||
read_lock(&list_lock);
|
||||
|
||||
for (var = head; var; var = var->next) {
|
||||
if (strcmp(proc_name, var->name) == 0) {
|
||||
atomic_inc(&var->refcount);
|
||||
info->var = var;
|
||||
read_unlock(&list_lock);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
read_unlock(&list_lock);
|
||||
|
||||
/* At this point, we need to allocate a new condition variable */
|
||||
newvar = kmalloc(sizeof(struct condition_variable), GFP_KERNEL);
|
||||
|
||||
if (!newvar)
|
||||
return -ENOMEM;
|
||||
|
||||
/* Create the condition variable's proc file entry */
|
||||
newvar->status_proc = proc_create_data(proc_name, 0644, proc_net_condition, &proc_fops, newvar);
|
||||
|
||||
if (!newvar->status_proc) {
|
||||
/*
|
||||
* There are two possibilities:
|
||||
* 1- Another condition variable with the same name has been created, which is valid.
|
||||
* 2- There was a memory allocation error.
|
||||
*/
|
||||
kfree(newvar);
|
||||
read_lock(&list_lock);
|
||||
|
||||
for (var = head; var; var = var->next) {
|
||||
if (strcmp(proc_name, var->name) == 0) {
|
||||
atomic_inc(&var->refcount);
|
||||
info->var = var;
|
||||
read_unlock(&list_lock);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
read_unlock(&list_lock);
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
atomic_set(&newvar->refcount, 1);
|
||||
info->var = newvar;
|
||||
newvar->enabled = 0;
|
||||
strcpy(newvar->name, proc_name);
|
||||
|
||||
write_lock(&list_lock);
|
||||
|
||||
newvar->next = head;
|
||||
head = newvar;
|
||||
|
||||
write_unlock(&list_lock);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void
|
||||
_xt_condition_safe_destroy(struct condition_info *info)
|
||||
{
|
||||
struct condition_variable *var, *prev = NULL;
|
||||
char proc_name[CONDITION_NAME_LEN] = "";
|
||||
|
||||
/* Ensure input string null terminated */
|
||||
strncpy(proc_name, info->name, CONDITION_NAME_LEN);
|
||||
proc_name[CONDITION_NAME_LEN-1] = '\0';
|
||||
|
||||
write_lock(&list_lock);
|
||||
|
||||
for (var = head; var && strcmp(proc_name, var->name);
|
||||
prev = var, var = var->next);
|
||||
|
||||
BUG_ON(var != info->var);
|
||||
|
||||
if (var && atomic_dec_and_test(&var->refcount)) {
|
||||
if (prev)
|
||||
prev->next = var->next;
|
||||
else
|
||||
head = var->next;
|
||||
|
||||
write_unlock(&list_lock);
|
||||
remove_proc_entry(var->name, proc_net_condition);
|
||||
kfree(var);
|
||||
} else
|
||||
write_unlock(&list_lock);
|
||||
}
|
||||
|
||||
static int
|
||||
xt_condition_checkentry(const struct xt_mtchk_param *par)
|
||||
{
|
||||
struct condition_info *info = (struct condition_info *)par->matchinfo;
|
||||
|
||||
return _xt_condition_safe_get_or_create(info);
|
||||
}
|
||||
|
||||
static void
|
||||
xt_condition_destroy(const struct xt_mtdtor_param *par)
|
||||
{
|
||||
struct condition_info *info = (struct condition_info *)par->matchinfo;
|
||||
|
||||
_xt_condition_safe_destroy(info);
|
||||
}
|
||||
|
||||
static int
|
||||
condition_tg4_check(const struct xt_tgchk_param *par)
|
||||
{
|
||||
struct condition_info *info = (struct condition_info *)par->targinfo;
|
||||
|
||||
return _xt_condition_safe_get_or_create(info);
|
||||
}
|
||||
|
||||
static unsigned int
|
||||
condition_tg4(struct sk_buff *skb, const struct xt_action_param *par)
|
||||
{
|
||||
struct condition_info *info = (struct condition_info *)par->targinfo;
|
||||
struct condition_variable *var = info->var;
|
||||
|
||||
WARN_ON(var == NULL);
|
||||
|
||||
if (var != NULL)
|
||||
var->enabled = info->invert ? 0 : 1;
|
||||
|
||||
return XT_CONTINUE;
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
condition_tg4_destroy(const struct xt_tgdtor_param *par)
|
||||
{
|
||||
struct condition_info *info = (struct condition_info *)par->targinfo;
|
||||
|
||||
_xt_condition_safe_destroy(info);
|
||||
}
|
||||
|
||||
static struct xt_match condition_match __read_mostly = {
|
||||
.name = "condition",
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.checkentry = xt_condition_checkentry,
|
||||
.match = xt_condition_match,
|
||||
.destroy = xt_condition_destroy,
|
||||
.matchsize = sizeof(struct condition_info),
|
||||
.me = THIS_MODULE,
|
||||
};
|
||||
|
||||
static struct xt_target condition_tg4_reg __read_mostly = {
|
||||
.name = "CONDITION",
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.target = condition_tg4,
|
||||
.targetsize = sizeof(struct condition_info),
|
||||
.checkentry = condition_tg4_check,
|
||||
.destroy = condition_tg4_destroy,
|
||||
.me = THIS_MODULE,
|
||||
};
|
||||
|
||||
static int __init
|
||||
init(void)
|
||||
{
|
||||
int errorcode;
|
||||
|
||||
rwlock_init(&list_lock);
|
||||
proc_net_condition = proc_mkdir("ipt_condition", init_net.proc_net);
|
||||
|
||||
if (proc_net_condition) {
|
||||
errorcode = xt_register_match(&condition_match);
|
||||
|
||||
if (!errorcode) {
|
||||
errorcode = xt_register_target(&condition_tg4_reg);
|
||||
|
||||
if (errorcode)
|
||||
xt_unregister_match(&condition_match);
|
||||
}
|
||||
|
||||
if (errorcode)
|
||||
remove_proc_entry("ipt_condition", init_net.proc_net);
|
||||
} else
|
||||
errorcode = -EACCES;
|
||||
|
||||
return errorcode;
|
||||
}
|
||||
|
||||
|
||||
static void __exit
|
||||
fini(void)
|
||||
{
|
||||
xt_unregister_match(&condition_match);
|
||||
xt_unregister_target(&condition_tg4_reg);
|
||||
remove_proc_entry("ipt_condition", init_net.proc_net);
|
||||
}
|
||||
|
||||
module_init(init);
|
||||
module_exit(fini);
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
/*
|
||||
* xt_condition
|
||||
* iptables kernel module for userspace condition match.
|
||||
*
|
||||
* Copyright (c) Theo Julienne <theo@github.com>
|
||||
*
|
||||
* Based on original ipt_condition:
|
||||
* Copyright (c) Stephane Ouellette <ouellettes@videotron.ca>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#ifndef __XT_CONDITION_MATCH__
|
||||
#define __XT_CONDITION_MATCH__
|
||||
|
||||
#define CONDITION_NAME_LEN 32
|
||||
|
||||
struct condition_info {
|
||||
char name[CONDITION_NAME_LEN];
|
||||
uint8_t invert;
|
||||
|
||||
/* kernel use: copy of the condition variable
|
||||
* note that ".userspacesize" in the iptables extension doesn't include this field.
|
||||
* when a rule is first checked, we also throw away this value and replace it with
|
||||
* a trusted copy.
|
||||
* Reference: http://inai.de/documents/Netfilter_Modules.pdf
|
||||
* (4.5 Attaching kernel-specific data)
|
||||
*/
|
||||
struct condition_variable *var __attribute__((aligned(8)));
|
||||
};
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
/* Kernel module to match syncookie metadata
|
||||
*
|
||||
* Copyright (c) 2015 Theo Julienne <theo@github.com>
|
||||
*
|
||||
* Based on xt_state.c:
|
||||
* Copyright (c) 1999-2001 Paul `Rusty' Russell
|
||||
* Copyright (c) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#include <linux/module.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/netfilter/x_tables.h>
|
||||
#include <net/tcp.h>
|
||||
#include "xt_syncookies.h"
|
||||
|
||||
static inline int
|
||||
inet_csk_reqsk_queue_is_above_percent(const struct sock *sk, uint8_t percent)
|
||||
{
|
||||
const struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
|
||||
unsigned int watermark = (queue->listen_opt->nr_table_entries * percent) / 100;
|
||||
return reqsk_queue_len(queue) > watermark;
|
||||
}
|
||||
|
||||
static bool
|
||||
syncookies_accepted(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
{
|
||||
const struct xt_syncookies_info *sinfo = par->matchinfo;
|
||||
struct iphdr *iph;
|
||||
struct tcphdr *th, _th;
|
||||
const struct net_device *net_dev = (par->in ? par->in : par->out);
|
||||
struct net *net;
|
||||
struct sock *listen_sk;
|
||||
bool want_cookie = false;
|
||||
|
||||
/* Early exit, wont be allowed regardless of count */
|
||||
if (sysctl_tcp_syncookies == 0)
|
||||
return false;
|
||||
|
||||
if (net_dev == NULL)
|
||||
return false;
|
||||
|
||||
net = dev_net(net_dev);
|
||||
if (net == NULL)
|
||||
return false;
|
||||
|
||||
th = skb_header_pointer(skb, par->thoff, sizeof(_th), &_th);
|
||||
if (th == NULL)
|
||||
return false;
|
||||
|
||||
iph = ip_hdr(skb);
|
||||
if (iph == NULL)
|
||||
return false;
|
||||
|
||||
/* Find a LISTEN socket for this packet, if available. */
|
||||
listen_sk = inet_lookup_listener(net, &tcp_hashinfo,
|
||||
iph->saddr, th->source,
|
||||
iph->daddr, th->dest, net_dev->ifindex);
|
||||
|
||||
/* Perform the usual check for whether a syncookie ACK would be accepted
|
||||
* right now. */
|
||||
if (listen_sk) {
|
||||
if (sinfo->mode == O_XT_SYNCOOKIES_SENT) {
|
||||
want_cookie = (sysctl_tcp_syncookies == 2 ||
|
||||
inet_csk_reqsk_queue_is_full(listen_sk));
|
||||
} else if (sinfo->mode == O_XT_SYNCOOKIES_ACCEPTED) {
|
||||
want_cookie = !tcp_synq_no_recent_overflow(listen_sk);
|
||||
} else if (sinfo->mode == O_XT_SYNCOOKIES_LEVEL) {
|
||||
want_cookie = inet_csk_reqsk_queue_is_above_percent(
|
||||
listen_sk, sinfo->queue_level_percent);
|
||||
}
|
||||
sock_put(listen_sk);
|
||||
}
|
||||
|
||||
return want_cookie;
|
||||
}
|
||||
|
||||
static bool
|
||||
syncookies_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
{
|
||||
const struct xt_syncookies_info *sinfo = par->matchinfo;
|
||||
|
||||
bool result = syncookies_accepted(skb, par);
|
||||
|
||||
if (sinfo->invert)
|
||||
result = !result;
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
static int syncookies_mt_check(const struct xt_mtchk_param *par)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void syncookies_mt_destroy(const struct xt_mtdtor_param *par)
|
||||
{
|
||||
|
||||
}
|
||||
|
||||
static struct xt_match syncookies_mt_reg __read_mostly = {
|
||||
.name = "syncookies",
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.checkentry = syncookies_mt_check,
|
||||
.match = syncookies_mt,
|
||||
.destroy = syncookies_mt_destroy,
|
||||
.matchsize = sizeof(struct xt_syncookies_info),
|
||||
.me = THIS_MODULE,
|
||||
};
|
||||
|
||||
static int __init syncookies_mt_init(void)
|
||||
{
|
||||
return xt_register_match(&syncookies_mt_reg);
|
||||
}
|
||||
|
||||
static void __exit syncookies_mt_exit(void)
|
||||
{
|
||||
xt_unregister_match(&syncookies_mt_reg);
|
||||
}
|
||||
|
||||
module_init(syncookies_mt_init);
|
||||
module_exit(syncookies_mt_exit);
|
||||
|
||||
MODULE_LICENSE("GPL");
|
||||
MODULE_AUTHOR("Theo Julienne <theo@github.com>");
|
||||
MODULE_DESCRIPTION("ip[6]_tables syncookie metadata match module");
|
||||
MODULE_ALIAS("ipt_syncookies");
|
||||
MODULE_ALIAS("ip6t_syncookies");
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
/* Kernel module to match syncookie metadata
|
||||
*
|
||||
* Copyright (c) 2015 Theo Julienne <theo@github.com>
|
||||
*
|
||||
* Based on xt_state.c:
|
||||
* Copyright (c) 1999-2001 Paul `Rusty' Russell
|
||||
* Copyright (c) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 as
|
||||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#ifndef _XT_SYNCOOKIES_H
|
||||
#define _XT_SYNCOOKIES_H
|
||||
|
||||
enum {
|
||||
O_XT_SYNCOOKIES_ACCEPTED = 0,
|
||||
O_XT_SYNCOOKIES_SENT = 1,
|
||||
O_XT_SYNCOOKIES_LEVEL = 2,
|
||||
};
|
||||
|
||||
struct xt_syncookies_info {
|
||||
uint8_t invert;
|
||||
uint8_t mode;
|
||||
uint8_t queue_level_percent;
|
||||
};
|
||||
|
||||
#endif /*_XT_SYNCOOKIES_H*/
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
#!/bin/sh -e
|
||||
#
|
||||
# This program is licensed under the MIT license. See LICENSE.MIT for details.
|
||||
|
||||
CHAIN=$1
|
||||
CONDITION_NAME=$2
|
||||
INTERFACE=$3
|
||||
PORT=$4
|
||||
|
||||
if [ -z $CHAIN ]
|
||||
then
|
||||
echo "Chain must be specified."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z $CONDITION_NAME ]
|
||||
then
|
||||
echo "Condition name must be specified."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z $INTERFACE ]
|
||||
then
|
||||
echo "Interface must be specified."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z $PORT ]
|
||||
then
|
||||
echo "Port must be specified."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# load all the modules before trying to add rules
|
||||
modprobe ipt_SYNSANITY
|
||||
modprobe xt_syncookies
|
||||
modprobe xt_condition
|
||||
|
||||
# If our condition variable is set, don't track SYN packets - we'll use this
|
||||
# next as a match to trigger that synsanity should handle them. This prevents
|
||||
# conntrack from locking on a SYN flood.
|
||||
iptables -t raw -I PREROUTING -i $INTERFACE \
|
||||
-p tcp -m tcp --tcp-flags SYN SYN --dport $PORT \
|
||||
-m condition --condition $CONDITION_NAME \
|
||||
-j CT --notrack
|
||||
|
||||
# Trigger condition variable when the SYN queue on the LISTEN socket backing
|
||||
# this port hits a watermark of 90%
|
||||
iptables -t raw -I PREROUTING -i $INTERFACE \
|
||||
-p tcp -m tcp --tcp-flags SYN SYN --dport $PORT \
|
||||
-m condition ! --condition $CONDITION_NAME \
|
||||
-m syncookies --syn-queue-level 90 \
|
||||
-j CONDITION --condition $CONDITION_NAME
|
||||
|
||||
# When the packet then makes it to the INPUT chain in the filter table, we
|
||||
# check again to see if the condition is set. If it is, we'll handle completely
|
||||
# using synsanity's mitigation rules. Otherwise, we fall back to normal
|
||||
# simplistic firewall rules.
|
||||
iptables -I $CHAIN -i $INTERFACE \
|
||||
-p tcp -m tcp --dport $PORT \
|
||||
-m condition --condition $CONDITION_NAME \
|
||||
-j synsanity-mitigation
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
#!/usr/bin/env bash
|
||||
#
|
||||
# This program is licensed under the MIT license. See LICENSE.MIT for details.
|
||||
|
||||
STATE_OK=0
|
||||
STATE_WARNING=1
|
||||
STATE_CRITICAL=2
|
||||
STATE_UNKNOWN=3
|
||||
STATE_DEPENDENT=4
|
||||
|
||||
if [ -z $1 ]
|
||||
then
|
||||
echo "Port must be provided as an argument!"
|
||||
exit $STATE_UNKNOWN
|
||||
fi
|
||||
|
||||
if [ ! -f /proc/net/ipt_condition/synsanity-mitigation-"$1" ]
|
||||
then
|
||||
echo "IPT Condition procfile doesn't exist!"
|
||||
exit $STATE_UNKNOWN
|
||||
fi
|
||||
|
||||
cat /proc/net/ipt_condition/synsanity-mitigation-"$1" | grep -q 0 2>&1
|
||||
|
||||
if [ $? -eq 0 ]
|
||||
then
|
||||
echo "SYNSANITY mitigation for port $1 is currently disabled. Everything is OK."
|
||||
exit $STATE_OK
|
||||
else
|
||||
echo "SYNSANITY mitigation for port $1 is currently ENABLED. Put on your DDoS attack hat."
|
||||
exit $STATE_CRITICAL
|
||||
fi
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
#!/bin/sh -e
|
||||
#
|
||||
# This program is licensed under the MIT license. See LICENSE.MIT for details.
|
||||
|
||||
WSCALE=10
|
||||
TCP_MSS=1436
|
||||
|
||||
# make sure our modules are all available
|
||||
modprobe nf_synproxy_core
|
||||
modprobe nf_conntrack_ipv4
|
||||
modprobe ipt_SYNSANITY
|
||||
modprobe xt_syncookies
|
||||
modprobe xt_condition
|
||||
|
||||
/sbin/sysctl -w net/netfilter/nf_conntrack_tcp_loose=1
|
||||
/sbin/sysctl -w net/ipv4/tcp_syncookies=1
|
||||
/sbin/sysctl -w net/ipv4/tcp_timestamps=1
|
||||
|
||||
iptables -t raw -F PREROUTING
|
||||
iptables -N synsanity-mitigation || true
|
||||
iptables -F synsanity-mitigation
|
||||
|
||||
# set up synsanity for each condition name, interface and port we require
|
||||
scripts/add_synsanity_rule INPUT synsanity-mitigation-80 eth0 80
|
||||
scripts/add_synsanity_rule INPUT synsanity-mitigation-443 eth0 443
|
||||
|
||||
|
||||
## Below are generic synsanity options that are used when mitigation enabled ##
|
||||
|
||||
# Any valid packets for existing, tracked connections are accepted
|
||||
iptables -A synsanity-mitigation \
|
||||
-m conntrack --ctstate ESTABLISHED,RELATED \
|
||||
-j ACCEPT
|
||||
# Allow through RST packets since they don't hold LISTEN lock, and Azure had
|
||||
# issues if we didn't. don't care what the state is
|
||||
iptables -A synsanity-mitigation -p tcp -m tcp --tcp-flags RST RST -j ACCEPT
|
||||
|
||||
# SYN packets will be handled by SYNSANITY completely if syncookies enabled
|
||||
iptables -A synsanity-mitigation \
|
||||
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN \
|
||||
-m conntrack --ctstate UNTRACKED \
|
||||
-j SYNSANITY --sack-perm --timestamp \
|
||||
--wscale $WSCALE --mss $TCP_MSS
|
||||
# To be explicit, SYN packets that were UNTRACKED should always be handled by
|
||||
# SYNSANITY. If it falls through, drop it anyway.
|
||||
iptables -A synsanity-mitigation \
|
||||
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN \
|
||||
-m conntrack --ctstate UNTRACKED \
|
||||
-j DROP
|
||||
# SYN packets that were tracked (aka not UNTRACKED) should go to the kernel tcp
|
||||
# stack as per usual.
|
||||
iptables -A synsanity-mitigation \
|
||||
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN \
|
||||
-j ACCEPT
|
||||
# All other packets containing SYN (including SYN-ACKs) are invalid.
|
||||
iptables -A synsanity-mitigation -p tcp -m tcp --tcp-flags SYN SYN -j DROP
|
||||
|
||||
# at this point, SYNs are completely gone
|
||||
|
||||
# ACK packets for new connections (responses to SYN-ACK) should be checked by
|
||||
# SYNSANITY, valid cookies will continue to the kernel, invalid cookies will
|
||||
# be dropped
|
||||
iptables -A synsanity-mitigation \
|
||||
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK ACK \
|
||||
-m conntrack --ctstate INVALID,NEW \
|
||||
-j SYNSANITY --sack-perm --timestamp \
|
||||
--wscale $WSCALE --mss $TCP_MSS
|
||||
# If the ACK is creating a connection and SYNSANITY was fine with it, let it
|
||||
# through for the kernel tcp stack to handle.
|
||||
iptables -A synsanity-mitigation \
|
||||
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK ACK \
|
||||
-m conntrack --ctstate INVALID,NEW \
|
||||
-j ACCEPT
|
||||
|
||||
# Drop invalid packets except for ACK packets (which SYNSANITY will allow
|
||||
# through, and should go to the kernel directly)
|
||||
iptables -A synsanity-mitigation \
|
||||
-m conntrack --ctstate INVALID \
|
||||
-p tcp -m tcp ! --tcp-flags ALL ACK -j DROP
|
||||
Загрузка…
Ссылка в новой задаче