kernel.patches/3.2.34/net-netfilter-psd.patch

---
 include/linux/netfilter_ipv4/ipt_psd.h |   40 +++
 net/ipv4/netfilter/Makefile            |    1 
 net/ipv4/netfilter/ipt_psd.c           |  358 +++++++++++++++++++++++++++++++++
 3 files changed, 399 insertions(+)

--- /dev/null
+++ b/net/ipv4/netfilter/ipt_psd.c
@@ -0,0 +1,358 @@
+/*
+  This is a module which is used for PSD (portscan detection)
+  Derived from scanlogd v2.1 written by Solar Designer <solar@false.com>
+  and LOG target module.
+
+  Copyright (C) 2000,2001 astaro AG
+
+  This file is distributed under the terms of the GNU General Public
+  License (GPL). Copies of the GPL can be obtained from:
+     ftp://prep.ai.mit.edu/pub/gnu/GPL
+
+  2000-05-04 Markus Hennig <hennig@astaro.de> : initial
+  2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
+  2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
+  2001-01-02 Dennis Koslowski <koslowski@astaro.de> : output modified
+  2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
+  2004-05-05 Martijn Lievaart <m@rtij.nl> : ported to 2.6
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_psd.h>
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Dennis Koslowski <koslowski@astaro.com>");
+
+#define HF_DADDR_CHANGING   0x01
+#define HF_SPORT_CHANGING   0x02
+#define HF_TOS_CHANGING	    0x04
+#define HF_TTL_CHANGING	    0x08
+
+/*
+ * Information we keep per each target port
+ */
+struct port {
+	u_int16_t number;      /* port number */
+	u_int8_t proto;        /* protocol number */
+	u_int8_t and_flags;    /* tcp ANDed flags */
+	u_int8_t or_flags;     /* tcp ORed flags */
+};
+
+/*
+ * Information we keep per each source address.
+ */
+struct host {
+	struct host *next;		/* Next entry with the same hash */
+	clock_t timestamp;		/* Last update time */
+	struct in_addr src_addr;	/* Source address */
+	struct in_addr dest_addr;	/* Destination address */
+	unsigned short src_port;	/* Source port */
+	int count;			/* Number of ports in the list */
+	int weight;			/* Total weight of ports in the list */
+	struct port ports[SCAN_MAX_COUNT - 1];	/* List of ports */
+	unsigned char tos;		/* TOS */
+	unsigned char ttl;		/* TTL */
+	unsigned char flags;		/* HF_ flags bitmask */
+};
+
+/*
+ * State information.
+ */
+static struct {
+	spinlock_t lock;
+	struct host list[LIST_SIZE];	/* List of source addresses */
+	struct host *hash[HASH_SIZE];	/* Hash: pointers into the list */
+	int index;			/* Oldest entry to be replaced */
+} state;
+
+/*
+ * Convert an IP address into a hash table index.
+ */
+static inline int hashfunc(struct in_addr addr)
+{
+	unsigned int value;
+	int hash;
+
+	value = addr.s_addr;
+	hash = 0;
+	do {
+		hash ^= value;
+	} while ((value >>= HASH_LOG));
+
+	return hash & (HASH_SIZE - 1);
+}
+
+static int
+ipt_psd_match(const struct sk_buff *pskb,
+	      const struct net_device *in,
+	      const struct net_device *out,
+	      const void *matchinfo,
+	      int offset,
+	      int *hotdrop)
+{
+	struct iphdr *ip_hdr;
+	struct tcphdr *tcp_hdr;
+	struct in_addr addr;
+	u_int16_t src_port,dest_port;
+  	u_int8_t tcp_flags, proto;
+	clock_t now;
+	struct host *curr, *last, **head;
+	int hash, index, count;
+
+	/* Parameters from userspace */
+	const struct ipt_psd_info *psdinfo = matchinfo;
+
+	/* IP header */
+	ip_hdr = pskb->nh.iph;
+
+	/* Sanity check */
+	if (ntohs(ip_hdr->frag_off) & IP_OFFSET) {
+		DEBUGP("PSD: sanity check failed\n");
+		return 0;
+	}
+
+	/* TCP or UDP ? */
+	proto = ip_hdr->protocol;
+
+	if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) {
+		DEBUGP("PSD: protocol not supported\n");
+		return 0;
+	}
+
+	/* Get the source address, source & destination ports, and TCP flags */
+
+	addr.s_addr = ip_hdr->saddr;
+
+	tcp_hdr = (struct tcphdr*)((u_int32_t *)ip_hdr + ip_hdr->ihl);
+
+	/* Yep, it´s dirty */
+	src_port = tcp_hdr->source;
+	dest_port = tcp_hdr->dest;
+
+	if (proto == IPPROTO_TCP) {
+		tcp_flags = *((u_int8_t*)tcp_hdr + 13);
+	}
+	else {
+		tcp_flags = 0x00;
+	}
+
+	/* We're using IP address 0.0.0.0 for a special purpose here, so don't let
+	 * them spoof us. [DHCP needs this feature - HW] */
+	if (!addr.s_addr) {
+		DEBUGP("PSD: spoofed source address (0.0.0.0)\n");
+		return 0;
+	}
+
+	/* Use jiffies here not to depend on someone setting the time while we're
+	 * running; we need to be careful with possible return value overflows. */
+	now = jiffies;
+
+	spin_lock(&state.lock);
+
+	/* Do we know this source address already? */
+	count = 0;
+	last = NULL;
+	if ((curr = *(head = &state.hash[hash = hashfunc(addr)])))
+		do {
+			if (curr->src_addr.s_addr == addr.s_addr) break;
+			count++;
+			if (curr->next) last = curr;
+		} while ((curr = curr->next));
+
+	if (curr) {
+
+		/* We know this address, and the entry isn't too old. Update it. */
+		if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
+		    time_after_eq(now, curr->timestamp)) {
+
+			/* Just update the appropriate list entry if we've seen this port already */
+			for (index = 0; index < curr->count; index++) {
+				if (curr->ports[index].number == dest_port) {
+					curr->ports[index].proto = proto;
+					curr->ports[index].and_flags &= tcp_flags;
+					curr->ports[index].or_flags |= tcp_flags;
+					goto out_no_match;
+				}
+			}
+
+			/* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */
+			if (proto == IPPROTO_TCP && (tcp_hdr->ack || tcp_hdr->rst))
+				goto out_no_match;
+
+			/* Packet to a new port, and not TCP/ACK: update the timestamp */
+			curr->timestamp = now;
+
+			/* Logged this scan already? Then drop the packet. */
+			if (curr->weight >= psdinfo->weight_threshold)
+				goto out_match;
+
+			/* Specify if destination address, source port, TOS or TTL are not fixed */
+			if (curr->dest_addr.s_addr != ip_hdr->daddr)
+				curr->flags |= HF_DADDR_CHANGING;
+			if (curr->src_port != src_port)
+				curr->flags |= HF_SPORT_CHANGING;
+			if (curr->tos != ip_hdr->tos)
+				curr->flags |= HF_TOS_CHANGING;
+			if (curr->ttl != ip_hdr->ttl)
+				curr->flags |= HF_TTL_CHANGING;
+
+			/* Update the total weight */
+			curr->weight += (ntohs(dest_port) < 1024) ?
+				psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
+
+			/* Got enough destination ports to decide that this is a scan? */
+			/* Then log it and drop the packet. */
+			if (curr->weight >= psdinfo->weight_threshold)
+				goto out_match;
+
+			/* Remember the new port */
+			if (curr->count < SCAN_MAX_COUNT) {
+				curr->ports[curr->count].number = dest_port;
+				curr->ports[curr->count].proto = proto;
+				curr->ports[curr->count].and_flags = tcp_flags;
+				curr->ports[curr->count].or_flags = tcp_flags;
+				curr->count++;
+			}
+
+			goto out_no_match;
+		}
+
+		/* We know this address, but the entry is outdated. Mark it unused, and
+		 * remove from the hash table. We'll allocate a new entry instead since
+		 * this one might get re-used too soon. */
+		curr->src_addr.s_addr = 0;
+		if (last)
+			last->next = last->next->next;
+		else if (*head)
+			*head = (*head)->next;
+		last = NULL;
+	}
+
+	/* We don't need an ACK from a new source address */
+	if (proto == IPPROTO_TCP && tcp_hdr->ack)
+		goto out_no_match;
+
+	/* Got too many source addresses with the same hash value? Then remove the
+	 * oldest one from the hash table, so that they can't take too much of our
+	 * CPU time even with carefully chosen spoofed IP addresses. */
+	if (count >= HASH_MAX && last) last->next = NULL;
+
+	/* We're going to re-use the oldest list entry, so remove it from the hash
+	 * table first (if it is really already in use, and isn't removed from the
+	 * hash table already because of the HASH_MAX check above). */
+
+	/* First, find it */
+	if (state.list[state.index].src_addr.s_addr)
+		head = &state.hash[hashfunc(state.list[state.index].src_addr)];
+	else
+		head = &last;
+	last = NULL;
+	if ((curr = *head))
+	do {
+		if (curr == &state.list[state.index]) break;
+		last = curr;
+	} while ((curr = curr->next));
+
+	/* Then, remove it */
+	if (curr) {
+		if (last)
+			last->next = last->next->next;
+		else if (*head)
+			*head = (*head)->next;
+	}
+
+	/* Get our list entry */
+	curr = &state.list[state.index++];
+	if (state.index >= LIST_SIZE) state.index = 0;
+
+	/* Link it into the hash table */
+	head = &state.hash[hash];
+	curr->next = *head;
+	*head = curr;
+
+	/* And fill in the fields */
+	curr->timestamp = now;
+	curr->src_addr = addr;
+	curr->dest_addr.s_addr = ip_hdr->daddr;
+	curr->src_port = src_port;
+	curr->count = 1;
+	curr->weight = (ntohs(dest_port) < 1024) ?
+		psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
+	curr->ports[0].number = dest_port;
+	curr->ports[0].proto = proto;
+	curr->ports[0].and_flags = tcp_flags;
+	curr->ports[0].or_flags = tcp_flags;
+	curr->tos = ip_hdr->tos;
+	curr->ttl = ip_hdr->ttl;
+
+out_no_match:
+	spin_unlock(&state.lock);
+	return 0;
+
+out_match:
+	spin_unlock(&state.lock);
+	return 1;
+}
+
+static int ipt_psd_checkentry(const char *tablename,
+			      const struct ipt_ip *e,
+			      void *matchinfo,
+			      unsigned int matchsize,
+			      unsigned int hook_mask)
+{
+/*	const struct ipt_psd_info *psdinfo = targinfo;*/
+
+	/* we accept TCP only */
+/*  	if (e->ip.proto != IPPROTO_TCP) { */
+/*  		DEBUGP("PSD: specified protocol may be TCP only\n"); */
+/*  		return 0; */
+/*  	} */
+
+	if (matchsize != IPT_ALIGN(sizeof(struct ipt_psd_info))) {
+		DEBUGP("PSD: matchsize %u != %u\n",
+		       matchsize,
+		       IPT_ALIGN(sizeof(struct ipt_psd_info)));
+		return 0;
+	}
+
+	return 1;
+}
+
+static struct ipt_match ipt_psd_reg = {
+	.name = "psd",
+	.match = ipt_psd_match,
+	.checkentry = ipt_psd_checkentry,
+	.me = THIS_MODULE };
+
+static int __init init(void)
+{
+	if (ipt_register_match(&ipt_psd_reg))
+		return -EINVAL;
+
+	memset(&state, 0, sizeof(state));
+
+	spin_lock_init(&(state.lock));
+
+	printk("netfilter PSD loaded - (c) astaro AG\n");
+	return 0;
+}
+
+static void __exit fini(void)
+{
+	ipt_unregister_match(&ipt_psd_reg);
+	printk("netfilter PSD unloaded - (c) astaro AG\n");
+}
+
+module_init(init);
+module_exit(fini);
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_psd.h
@@ -0,0 +1,40 @@
+#ifndef _IPT_PSD_H
+#define _IPT_PSD_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+/*
+ * High port numbers have a lower weight to reduce the frequency of false
+ * positives, such as from passive mode FTP transfers.
+ */
+#define PORT_WEIGHT_PRIV		3
+#define PORT_WEIGHT_HIGH		1
+
+/*
+ * Port scan detection thresholds: at least COUNT ports need to be scanned
+ * from the same source, with no longer than DELAY ticks between ports.
+ */
+#define SCAN_MIN_COUNT			7
+#define SCAN_MAX_COUNT			(SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
+#define SCAN_WEIGHT_THRESHOLD		SCAN_MAX_COUNT
+#define SCAN_DELAY_THRESHOLD		(300) /* old usage of HZ here was erroneously and broke under uml */
+
+/*
+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
+ * HASH_MAX source addresses per the same hash value.
+ */
+#define LIST_SIZE			0x100
+#define HASH_LOG			9
+#define HASH_SIZE			(1 << HASH_LOG)
+#define HASH_MAX			0x10
+
+struct ipt_psd_info {
+	unsigned int weight_threshold;
+	unsigned int delay_threshold;
+	unsigned short lo_ports_weight;
+	unsigned short hi_ports_weight;
+};
+
+#endif /*_IPT_PSD_H*/
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -49,6 +49,7 @@
 
 # matches
 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
+obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
 
 # targets