netfilter_queue: how to obtain address info from queued packet
Hello all,
I am quite a newbie to the netfilter world, so maybe my approach is naive. I would like to block communication coming from/to some ports according to the content of packets. Unfortunately these ports are not static, so port specific netfilter rule cannot be used. So my question is:
Is it possible to obtain some address info (source/destination address and ports) from the packet queued from netfilter?
Thanks in advance for any help,
Michal
Michal Martinek írta:
Quoted 4 lines
Hello all,
I am quite a newbie to the netfilter world, so maybe my approach is naive. I would like to block communication coming from/to some ports according to the content of packets. Unfortunately these ports are not static, so port specific netfilter rule cannot be used. So my question is:
Do you know the STRING module ?
Quoted 8 lines
Is it possible to obtain some address info (source/destination address and ports) from the packet queued from netfilter?
Thanks in advance for any help,
Michal
Quoted 7 lines · Gáspár Lajos
Michal Martinek írta:
Quoted 4 lines
Hello all,
I am quite a newbie to the netfilter world, so maybe my approach is naive. I would like to block communication coming from/to some ports according to the content of packets. Unfortunately these ports are not static, so port specific netfilter rule cannot be used. So my question is:
Do you know the STRING module ?
I'm afraid not. Can you give me some explanation (or link)?
Quoted 1 line
Quoted 1 line
Is it possible to obtain some address info (source/destination address and ports) from the packet queued from netfilter?
Michal Martinek írta:
Quoted 4 lines
Quoted 1 line · Gáspár Lajos
Quoted 8 lines
Quoted 6 lines
Michal Martinek írta:
Quoted 4 lines
Hello all,
I am quite a newbie to the netfilter world, so maybe my approach is naive. I would like to block communication coming from/to some ports according to the content of packets. Unfortunately these ports are not static, so port specific netfilter rule cannot be used. So my question is:
Do you know the STRING module ?
I'm afraid not. Can you give me some explanation (or link)?
Well... :) man iptables...
iptables -A FORWARD -j DROP -p tcp -m string --string 'Some string' --algo kmp
Quoted 4 lines
Quoted 2 lines
Quoted 2 lines
Is it possible to obtain some address info (source/destination address and ports) from the packet queued from netfilter?
Quoted 9 lines · Gáspár Lajos
Michal Martinek írta:
Quoted 7 lines
Quoted 4 lines · Gáspár Lajos
Michal Martinek írta:
Quoted 2 lines
Hello all,
Quoted 8 lines
Quoted 5 lines
Quoted 3 lines
Quoted 2 lines
I am quite a newbie to the netfilter world, so maybe my approach is naive. I would like to block communication coming from/to some ports according to the content of packets. Unfortunately these ports are not static, so port specific netfilter rule cannot be used. So my question is:
Do you know the STRING module ?
I'm afraid not. Can you give me some explanation (or link)?
Well... :) man iptables...
iptables -A FORWARD -j DROP -p tcp -m string --string 'Some string' --algo kmp
Thanks, I was too fast to answer without looking into man pages:-). But this module would just save me some work with analyzing packets. The problem is that I would like to detect video stream in which I can recognize only some "key packets". The rest is (for me) unrecongnizable and I only know that they are coming from/to the same port.
Quoted 6 lines
Quoted 4 lines
Quoted 2 lines
Quoted 2 lines
Is it possible to obtain some address info (source/destination address and ports) from the packet queued from netfilter?
Michal Martinek írta:
Quoted 3 lines
Thanks, I was too fast to answer without looking into man pages:-). But this module would just save me some work with analyzing packets. The problem is that I would like to detect video stream in which I can recognize only some "key packets". The rest is (for me) unrecongnizable and I only know that they are coming from/to the same port.
Well... It is not really clear to me what you want... :-) (Blocking some "communication" :-) .) You can drop the whole connection when you detect for example a header of a video stream.... This could be dangerous because you would drop some legitimate traffic too.
That is why you have to narrow your matching criterias. (eg.: adding some rules like "-i eth0" or "-s 192.168.0.1") An other good thing to look after is the l7 patch:
http://l7-filter.sourceforge.net/HOWTO
But there may be better solutions if you would clarify more your needs :)
Swifty
Quoted 2 lines · Michal Martinek
Quoted 1 line
Do you know the STRING module ?
I'm afraid not. Can you give me some explanation (or link)?
http://www.google.com/search?q=netfilter+string
By the way, string match is completely irrelevant to your question as it would allow you to match a given packet with a fixed already known value, not to extract a value you don't know from the packet.
What you want to achieve is a conntrack helper. You can have a look at existing ones, such as ip_conntrack_ftp, ip_conntack_irc, etc. You could also use QUEUE target to do the job in userland.
Signature · 2 lines
http://sid.rstack.org/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 2 lines
Quoted 2 lines
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!
Quoted 6 lines · Cedric Blancher
Quoted 2 lines · Michal Martinek
Quoted 1 line
Do you know the STRING module ?
I'm afraid not. Can you give me some explanation (or link)?
Quoted 7 lines
By the way, string match is completely irrelevant to your question as it would allow you to match a given packet with a fixed already known value, not to extract a value you don't know from the packet.
What you want to achieve is a conntrack helper. You can have a look at existing ones, such as
ip_conntrack_ftp,ip_conntack_irc, etc. You could also use QUEUE target to do the job in userland.
Thanks for help, I've already written some userspace packet analyzer acting as a NFQUEUE target, but the problem is, that not all of the packets I'd like to handle (mostly drop) are recognizable. It is a video stream, in which I can detect only some "key packets", but the rest remains unclear.
The easiest would be (at least I think), to drop everything on the port where I've detected those "key packets". But I don't know how to obtain the port number inside the (NF)QUEUE handler.
Do you think, that conntrack helper will help me with it?
Quoted 5 lines · Michal Martinek
Thanks for help, I've already written some userspace packet analyzer acting as a NFQUEUE target, but the problem is, that not all of the packets I'd like to handle (mostly drop) are recognizable. It is a video stream, in which I can detect only some "key packets", but the rest remains unclear.
OK, so if I understand you correctly... You have a video stream containing key packets you can spot. This video stream occurs on non predictable ports.
First solution, and apologies to Gáspár, use string match to identify your key packets. Then mark the entire connection using CONNMARK and drop it.
Something like:
iptables -t mangle -A FORWARD -m string --string "yourmagic" \ -j CONNMARK --set-mark 0x1 iptables -A FORWARD -m connmark --mark 0x1 -j DROP
This means once you've detected a key packet, you'll drop it as well as all further packets from the same connection.
Second solution, you write a helper. Maybe I don't quite well get your situation, but this stream does not come from nowhere. It's ports have to be negociated in some previous connection so your client application can open the right port. Thus, your helper would follow this negociation connection to identify on the fly streaming ports and block the entire video stream.
Signature · 2 lines
http://sid.rstack.org/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 2 lines
Quoted 2 lines
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!
Thanks a lot!
The solution with CONNMARK seems to be exactly what I need. It is also much better than drop everything on a given port :-).
Have a nice day,
Michal
Quoted 28 lines · Cedric Blancher
Quoted 1 line · Michal Martinek
Thanks for help, I've already written some userspace packet analyzer acting as a NFQUEUE target, but the problem is, that not all of the packets I'd like to handle (mostly drop) are recognizable. It is a video stream, in which I can detect only some "key packets", but the rest remains unclear.
OK, so if I understand you correctly... You have a video stream containing key packets you can spot. This video stream occurs on non predictable ports.
First solution, and apologies to Gáspár, use string match to identify your key packets. Then mark the entire connection using CONNMARK and drop it.
Something like:
iptables -t mangle -A FORWARD -m string --string "yourmagic" \ -j CONNMARK --set-mark 0x1 iptables -A FORWARD -m connmark --mark 0x1 -j DROPThis means once you've detected a key packet, you'll drop it as well as all further packets from the same connection.
Second solution, you write a helper. Maybe I don't quite well get your situation, but this stream does not come from nowhere. It's ports have to be negociated in some previous connection so your client application can open the right port. Thus, your helper would follow this negociation connection to identify on the fly streaming ports and block the entire video stream.