Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 48b1de4c authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: add SYNPROXY core/target 



Add a SYNPROXY for netfilter. The code is split into two parts, the synproxy
core with common functions and an address family specific target.

The SYNPROXY receives the connection request from the client, responds with
a SYN/ACK containing a SYN cookie and announcing a zero window and checks
whether the final ACK from the client contains a valid cookie.

It then establishes a connection to the original destination and, if
successful, sends a window update to the client with the window size
announced by the server.

Support for timestamps, SACK, window scaling and MSS options can be
statically configured as target parameters if the features of the server
are known. If timestamps are used, the timestamp value sent back to
the client in the SYN/ACK will be different from the real timestamp of
the server. In order to now break PAWS, the timestamps are translated in
the direction server->client.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Tested-by: default avatarMartin Topholm <mph@one.com>
Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0198230b

include/net/netfilter/nf_conntrack_extend.h

+5 −1
Original line number Diff line number Diff line
@@ -9,8 +9,8 @@ enum nf_ct_ext_id { 
	NF_CT_EXT_HELPER,

#if defined(CONFIG_NF_NAT) || defined(CONFIG_NF_NAT_MODULE)

	NF_CT_EXT_NAT,

	NF_CT_EXT_SEQADJ,

#endif

	NF_CT_EXT_SEQADJ,

	NF_CT_EXT_ACCT,

#ifdef CONFIG_NF_CONNTRACK_EVENTS

	NF_CT_EXT_ECACHE,
@@ -26,6 +26,9 @@ enum nf_ct_ext_id { 
#endif

#ifdef CONFIG_NF_CONNTRACK_LABELS

	NF_CT_EXT_LABELS,

#endif

#if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)

	NF_CT_EXT_SYNPROXY,

#endif

	NF_CT_EXT_NUM,

};
@@ -39,6 +42,7 @@ enum nf_ct_ext_id { 
#define NF_CT_EXT_TSTAMP_TYPE struct nf_conn_tstamp

#define NF_CT_EXT_TIMEOUT_TYPE struct nf_conn_timeout

#define NF_CT_EXT_LABELS_TYPE struct nf_conn_labels

#define NF_CT_EXT_SYNPROXY_TYPE struct nf_conn_synproxy



/* Extensions: optional stuff which isn't permanently in struct. */

struct nf_ct_ext {

include/net/netfilter/nf_conntrack_seqadj.h

+2 −0
Original line number Diff line number Diff line
@@ -30,6 +30,8 @@ static inline struct nf_conn_seqadj *nfct_seqadj_ext_add(struct nf_conn *ct) 
	return nf_ct_ext_add(ct, NF_CT_EXT_SEQADJ, GFP_ATOMIC);

}



extern int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo,

			     s32 off);

extern int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,

			    __be32 seq, s32 off);

extern void nf_ct_tcp_seqadj_set(struct sk_buff *skb,

include/net/netfilter/nf_conntrack_synproxy.h

0 → 100644
+77 −0
Original line number Diff line number Diff line 
#ifndef _NF_CONNTRACK_SYNPROXY_H

#define _NF_CONNTRACK_SYNPROXY_H



#include <net/netns/generic.h>



struct nf_conn_synproxy {

	u32	isn;

	u32	its;

	u32	tsoff;

};



static inline struct nf_conn_synproxy *nfct_synproxy(const struct nf_conn *ct)

{

#if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)

	return nf_ct_ext_find(ct, NF_CT_EXT_SYNPROXY);

#else

	return NULL;

#endif

}



static inline struct nf_conn_synproxy *nfct_synproxy_ext_add(struct nf_conn *ct)

{

#if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)

	return nf_ct_ext_add(ct, NF_CT_EXT_SYNPROXY, GFP_ATOMIC);

#else

	return NULL;

#endif

}



struct synproxy_stats {

	unsigned int			syn_received;

	unsigned int			cookie_invalid;

	unsigned int			cookie_valid;

	unsigned int			cookie_retrans;

	unsigned int			conn_reopened;

};



struct synproxy_net {

	struct nf_conn			*tmpl;

	struct synproxy_stats __percpu	*stats;

};



extern int synproxy_net_id;

static inline struct synproxy_net *synproxy_pernet(struct net *net)

{

	return net_generic(net, synproxy_net_id);

}



struct synproxy_options {

	u8				options;

	u8				wscale;

	u16				mss;

	u32				tsval;

	u32				tsecr;

};



struct tcphdr;

struct xt_synproxy_info;

extern void synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,

				   const struct tcphdr *th,

				   struct synproxy_options *opts);

extern unsigned int synproxy_options_size(const struct synproxy_options *opts);

extern void synproxy_build_options(struct tcphdr *th,

				   const struct synproxy_options *opts);



extern void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,

					   struct synproxy_options *opts);

extern void synproxy_check_timestamp_cookie(struct synproxy_options *opts);



extern unsigned int synproxy_tstamp_adjust(struct sk_buff *skb,

					   unsigned int protoff,

					   struct tcphdr *th,

					   struct nf_conn *ct,

					   enum ip_conntrack_info ctinfo,

					   const struct nf_conn_synproxy *synproxy);



#endif /* _NF_CONNTRACK_SYNPROXY_H */

include/uapi/linux/netfilter/xt_SYNPROXY.h

0 → 100644
+16 −0
Original line number Diff line number Diff line 
#ifndef _XT_SYNPROXY_H

#define _XT_SYNPROXY_H



#define XT_SYNPROXY_OPT_MSS		0x01

#define XT_SYNPROXY_OPT_WSCALE		0x02

#define XT_SYNPROXY_OPT_SACK_PERM	0x04

#define XT_SYNPROXY_OPT_TIMESTAMP	0x08

#define XT_SYNPROXY_OPT_ECN		0x10



struct xt_synproxy_info {

	__u8	options;

	__u8	wscale;

	__u16	mss;

};



#endif /* _XT_SYNPROXY_H */

net/ipv4/netfilter/Kconfig

+13 −0
Original line number Diff line number Diff line
@@ -110,6 +110,19 @@ config IP_NF_TARGET_REJECT 


	  To compile it as a module, choose M here.  If unsure, say N.



config IP_NF_TARGET_SYNPROXY

	tristate "SYNPROXY target support"

	depends on NF_CONNTRACK && NETFILTER_ADVANCED

	select NETFILTER_SYNPROXY

	select SYN_COOKIES

	help

	  The SYNPROXY target allows you to intercept TCP connections and

	  establish them using syncookies before they are passed on to the

	  server. This allows to avoid conntrack and server resource usage

	  during SYN-flood attacks.



	  To compile it as a module, choose M here. If unsure, say N.



config IP_NF_TARGET_ULOG

	tristate "ULOG target support (obsolete)"

	default m if NETFILTER_ADVANCED=n