netfilter: xtables target SYNPROXY
Subsystems (4)
PATCH v2 1/1 netfilter: xtables target SYNPROXY
xtables target SYNPROXY.
This patch implements an xtables target SYNPROXY. As the connection to the TCP server won't be established until the ACK from the client is received, it can protect the TCP server from the SYN-flood attacks.
It works in the raw table of the PREROUTING chain, before conntracking system. Syncookies is used, so no new state is introduced into the conntracking system. In fact, until the first connection is established, conntracking system doesn't see any packets. So when there is a SYN-flood attack, conntracking system won't be busy on finding and deleting the un-assured ct.
As the SYN-packet of the second connection request is sent locally, the DNAT rules which are in the PREROUTING chain should be moved to the OUTPUT chain.
Signed-off-by Changli Gao <[email protected]>
----
include/net/netfilter/nf_conntrack.h | 10 include/net/netfilter/nf_conntrack_core.h | 21 include/net/netfilter/nf_conntrack_extend.h | 2 include/net/tcp.h | 7 net/ipv4/syncookies.c | 22 net/ipv4/tcp_ipv4.c | 9 net/netfilter/Kconfig | 17 net/netfilter/Makefile | 1 net/netfilter/nf_conntrack_core.c | 45 + net/netfilter/xt_SYNPROXY.c | 678 ++++++++++++++++++++++++++++ 10 files changed, 793 insertions(+), 19 deletions(-)
include/net/netfilter/nf_conntrack.h +10 -0
@@ -311,5 +311,15 @@ do { \#define MODULE_ALIAS_NFCT_HELPER (helper) \ MODULE_ALIAS("nfct-helper-" helper) +#if defined(CONFIG_NETFILTER_XT_TARGET_SYNPROXY ) || \ + defined(CONFIG_NETFILTER_XT_TARGET_SYNPROXY_MODULE ) +extern unsigned int (*syn_proxy_pre_hook)(struct sk_buff *skb, +struct nf_conn *ct, +enum ip_conntrack_info ctinfo); + +extern unsigned int (*syn_proxy_post_hook)(struct sk_buff *skb, +struct nf_conn *ct, +enum ip_conntrack_info ctinfo); +#endif #endif /* __KERNEL__ */ #endif /* _NF_CONNTRACK_H */
include/net/netfilter/nf_conntrack_core.h +20 -1
@@ -54,6 +54,23 @@ nf_conntrack_find_get(struct net *net, u16 zone,extern int __nf_conntrack_confirm (struct sk_buff *skb); +static inline unsigned int syn_proxy_post_call (struct sk_buff *skb, +struct nf_conn *ct, +enum ip_conntrack_info ctinfo) +{ +unsigned int ret =NF_ACCEPT ; +#if defined(CONFIG_NETFILTER_XT_TARGET_SYNPROXY ) || \ + defined(CONFIG_NETFILTER_XT_TARGET_SYNPROXY_MODULE ) +unsigned int (*syn_proxy)(struct sk_buff *,struct nf_conn *, +enum ip_conntrack_info ); + syn_proxy =rcu_dereference (syn_proxy_post_hook); +if (syn_proxy) + ret =syn_proxy (skb, ct, ctinfo); +#endif + +return ret; +} +/* Confirm a connection: returns NF_DROP if packet must be dropped. */ static inline int nf_conntrack_confirm (struct sk_buff *skb) {
@@ -63,8 +80,10 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)if (ct && !nf_ct_is_untracked (ct)) {if (!nf_ct_is_confirmed (ct)) ret =__nf_conntrack_confirm (skb); -if (likely (ret ==NF_ACCEPT )) +if (likely (ret ==NF_ACCEPT )) {nf_ct_deliver_cached_events (ct); + ret =syn_proxy_post_call (skb, ct, skb->nfctinfo); + } }return ret; }
include/net/netfilter/nf_conntrack_extend.h +2 -0
@@ -11,6 +11,7 @@ enum nf_ct_ext_id {NF_CT_EXT_ACCT ,NF_CT_EXT_ECACHE ,NF_CT_EXT_ZONE , +NF_CT_EXT_SYNPROXY , NF_CT_EXT_NUM, };
@@ -19,6 +20,7 @@ enum nf_ct_ext_id {#define NF_CT_EXT_ACCT_TYPE struct nf_conn_counter#define NF_CT_EXT_ECACHE_TYPE struct nf_conntrack_ecache#define NF_CT_EXT_ZONE_TYPE struct nf_conntrack_zone +#define NF_CT_EXT_SYNPROXY_TYPE struct syn_proxy_state/* Extensions: optional stuff which isn't permanently in struct. */ struct nf_ct_ext {
include/net/tcp.h +5 -2
@@ -460,8 +460,11 @@ extern int tcp_disconnect(struct sock *sk, int flags);extern __u32 syncookie_secret[2 ][16 -4 +SHA_DIGEST_WORDS ];extern struct sock *cookie_v4_check (struct sock *sk,struct sk_buff *skb,struct ip_options *opt); -extern __u32 cookie_v4_init_sequence (struct sock *sk,struct sk_buff *skb, -__u16 *mss); +extern __u32 __cookie_v4_init_sequence (__be32 saddr,__be32 daddr, +__be16 sport,__be16 dport,__u32 seq, +__u16 *mssp); +extern int cookie_v4_check_sequence (const struct iphdr *iph, +const struct tcphdr *th,__u32 cookie);extern __u32 cookie_init_timestamp (struct request_sock *req);extern bool cookie_check_timestamp (struct tcp_options_received *opt,bool *);
net/ipv4/syncookies.c +9 -13
@@ -159,26 +159,21 @@ static __u16 const msstab[] = {* Generate a syncookie. mssp points to the mss, which is returned * rounded down to the value encoded in the cookie. */ -__u32 cookie_v4_init_sequence (struct sock *sk,struct sk_buff *skb,__u16 *mssp) +__u32 __cookie_v4_init_sequence (__be32 saddr,__be32 daddr,__be16 sport, +__be16 dport,__u32 seq,__u16 *mssp) { -const struct iphdr *iph =ip_hdr (skb); -const struct tcphdr *th =tcp_hdr (skb);int mssind;const __u16 mss = *mssp; -tcp_synq_overflow (sk); -for (mssind =ARRAY_SIZE (msstab) -1 ; mssind ; mssind--)if (mss >= msstab[mssind])break ; *mssp = msstab[mssind]; -NET_INC_STATS_BH (sock_net (sk),LINUX_MIB_SYNCOOKIESSENT ); - -return secure_tcp_syn_cookie (iph->saddr, iph->daddr, - th->source, th->dest,ntohl (th->seq), +return secure_tcp_syn_cookie (saddr, daddr, sport, dport, seq, jiffies / (HZ *60 ), mssind); } +EXPORT_SYMBOL (__cookie_v4_init_sequence);/* * This (misnamed) value is the age of syncookie which is permitted.
@@ -191,10 +186,9 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)* Check if a ack sequence number is a valid syncookie. * Return the decoded mss if it is, or 0 if not. */ -static inline int cookie_check (struct sk_buff *skb,__u32 cookie) +int cookie_v4_check_sequence (const struct iphdr *iph,const struct tcphdr *th, +__u32 cookie) { -const struct iphdr *iph =ip_hdr (skb); -const struct tcphdr *th =tcp_hdr (skb);__u32 seq =ntohl (th->seq) -1 ; __u32 mssind = check_tcp_syn_cookie(cookie, iph->saddr, iph->daddr, th->source, th->dest, seq,
@@ -203,6 +197,7 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)return mssind <ARRAY_SIZE (msstab) ? msstab[mssind] :0 ; } +EXPORT_SYMBOL (cookie_v4_check_sequence); static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb, struct request_sock *req,
@@ -282,7 +277,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, goto out;if (tcp_synq_no_recent_overflow (sk) || - (mss =cookie_check (skb, cookie)) ==0 ) { + (mss =cookie_v4_check_sequence (ip_hdr (skb),tcp_hdr (skb), + cookie)) ==0 ) {NET_INC_STATS_BH (sock_net (sk),LINUX_MIB_SYNCOOKIESFAILED ); goto out; }
net/ipv4/tcp_ipv4.c +8 -1
@@ -1332,7 +1332,14 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)TCP_ECN_create_request (req,tcp_hdr (skb));if (want_cookie) { - isn =cookie_v4_init_sequence (sk, skb, &req->mss); +struct tcphdr *th; + +tcp_synq_overflow (sk); +NET_INC_STATS_BH (sock_net (sk),LINUX_MIB_SYNCOOKIESSENT ); + th =tcp_hdr (skb); + isn =__cookie_v4_init_sequence (saddr, daddr, th->source, + th->dest,ntohl (th->seq), + &req->mss); req->cookie_ts = tmp_opt.tstamp_ok; }else if (!isn) {struct inet_peer *peer =NULL ;
net/netfilter/Kconfig +17 -0
@@ -560,6 +560,23 @@ config NETFILTER_XT_TARGET_SECMARK To compile it as a module, choose M here. If unsure, say N. +config NETFILTER_XT_TARGET_SYNPROXY + tristate '"SYNPROXY" target support (EXPERIMENTAL)' + depends on EXPERIMENTAL + depends on SYN_COOKIES + depends on IP_NF_RAW + depends on NF_CONNTRACK + depends on NETFILTER_ADVANCED + help + The SYNPROXY target allows a raw rule to specify that some TCP + connections are relayed to protect the TCP servers from the SYN-flood + DoS attacks. Syn cookies is used to save the initial state, so no + conntrack is needed until the client side connection is established. + It frees the connection tracking system from creating/deleting + conntracks when SYN-flood DoS attack acts. + + To compile it as a module, choose M here. If unsure, say N. + config NETFILTER_XT_TARGET_TCPMSS tristate '"TCPMSS" target support' depends on (IPV6 || IPV6=n)
net/netfilter/Makefile +1 -0
@@ -62,6 +62,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP) += xt_TCPOPTSTRIP.o obj-$(CONFIG_NETFILTER_XT_TARGET_TEE) += xt_TEE.o obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o obj-$(CONFIG_NETFILTER_XT_TARGET_IDLETIMER) += xt_IDLETIMER.o +obj-$(CONFIG_NETFILTER_XT_TARGET_SYNPROXY) += xt_SYNPROXY.o # matches obj-$(CONFIG_NETFILTER_XT_MATCH_CLUSTER) += xt_cluster.o
net/netfilter/nf_conntrack_core.c +43 -2
75 lines not on this page · raw message
net/netfilter/xt_SYNPROXY.c new file +678 -0
678 lines not on this page · raw message