Skip to contentSkip to conversation

psd ported to 2.6

PATCH In review Martijn Lievaart 2 participants 2 messages May 11, 2004 – May 14, 2004 netfilter

lore
Share & tools
lore

Martijn Lievaart

author
#0 lore raw

PATCH 1/1 psd ported to 2.6

Hello,

Attached a patch to port the psd module to 2.6. I also removed an erroneous use of HZ as the constant 100, which precluded compiling under uml.

Regards,
Martijn Lievaart

psd/info +0 -1
diff --exclude='*~*' -U 3 -r -N patch-o-matic-ng/psd/info patch-o-matic-ng.new/psd/info
@@ -1,4 +1,3 @@
 Author: Dennis Koslowski <[email protected]>
 Status: Experimental
 Repository: base
-Requires: linux < 2.6.0
psd/linux/include/linux/netfilter_ipv4/ipt_psd.h +1 -1
diff --exclude='*~*' -U 3 -r -N patch-o-matic-ng/psd/linux/include/linux/netfilter_ipv4/ipt_psd.h patch-o-matic-ng.new/psd/linux/include/linux/netfilter_ipv4/ipt_psd.h
@@ -18,7 +18,7 @@
 #define SCAN_MIN_COUNT			7
 #define SCAN_MAX_COUNT			(SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
 #define SCAN_WEIGHT_THRESHOLD		SCAN_MAX_COUNT
-#define SCAN_DELAY_THRESHOLD		(HZ * 3)
+#define SCAN_DELAY_THRESHOLD		(300) /* old usage of HZ here was erroneously and broke under uml */
 
 /*
  * Keep track of up to LIST_SIZE source addresses, using a hash table of
psd/linux/net/ipv4/netfilter/Kconfig.ladd +6 -0
diff --exclude='*~*' -U 3 -r -N patch-o-matic-ng/psd/linux/net/ipv4/netfilter/Kconfig.ladd patch-o-matic-ng.new/psd/linux/net/ipv4/netfilter/Kconfig.ladd
@@ -1,3 +1,9 @@
 config IP_NF_MATCH_PSD
 	tristate  'psd match support'
 	depends on IP_NF_IPTABLES
+        help
+	  This option adds a `psd' match, which allows you to create rules in
+	  any iptables table wich will detect TCP and UDP port scans.
+
+	  If you want to compile it as a module, say M here and read
+	  Documentation/modules.txt.  If unsure, say `N'.
psd/linux-2.6/include/linux/netfilter_ipv4/ipt_psd.h +40 -0
diff --exclude='*~*' -U 3 -r -N patch-o-matic-ng/psd/linux-2.6/include/linux/netfilter_ipv4/ipt_psd.h patch-o-matic-ng.new/psd/linux-2.6/include/linux/netfilter_ipv4/ipt_psd.h
@@ -0,0 +1,40 @@
+#ifndef _IPT_PSD_H
+#define _IPT_PSD_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+/*
+ * High port numbers have a lower weight to reduce the frequency of false
+ * positives, such as from passive mode FTP transfers.
+ */
+#define PORT_WEIGHT_PRIV		3
+#define PORT_WEIGHT_HIGH		1
+
+/*
+ * Port scan detection thresholds: at least COUNT ports need to be scanned
+ * from the same source, with no longer than DELAY ticks between ports.
+ */
+#define SCAN_MIN_COUNT			7
+#define SCAN_MAX_COUNT			(SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
+#define SCAN_WEIGHT_THRESHOLD		SCAN_MAX_COUNT
+#define SCAN_DELAY_THRESHOLD		(300) /* old usage of HZ here was erroneously and broke under uml */
+
+/*
+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
+ * HASH_MAX source addresses per the same hash value.
+ */
+#define LIST_SIZE			0x100
+#define HASH_LOG			9
+#define HASH_SIZE			(1 << HASH_LOG)
+#define HASH_MAX			0x10
+
+struct ipt_psd_info {
+	unsigned int weight_threshold;
+	unsigned int delay_threshold;
+	unsigned short lo_ports_weight;
+	unsigned short hi_ports_weight;
+};
+
+#endif /*_IPT_PSD_H*/
psd/linux-2.6/net/ipv4/netfilter/ipt_psd.c +358 -0

358 lines not on this page · raw message