1. 08 Jun, 2009 2 commits
    • Evgeniy Polyakov's avatar
      netfilter: passive OS fingerprint xtables match · 11eeef41
      Evgeniy Polyakov authored
      Passive OS fingerprinting netfilter module allows to passively detect
      remote OS and perform various netfilter actions based on that knowledge.
      This module compares some data (WS, MSS, options and it's order, ttl, df
      and others) from packets with SYN bit set with dynamically loaded OS
      fingerprints.
      
      Fingerprint matching rules can be downloaded from OpenBSD source tree
      or found in archive and loaded via netfilter netlink subsystem into
      the kernel via special util found in archive.
      
      Archive contains library file (also attached), which was shipped
      with iptables extensions some time ago (at least when ipt_osf existed
      in patch-o-matic).
      
      Following changes were made in this release:
       * added NLM_F_CREATE/NLM_F_EXCL checks
       * dropped _rcu list traversing helpers in the protected add/remove calls
       * dropped unneded structures, debug prints, obscure comment and check
      
      Fingerprints can be downloaded from
      http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os
      or can be found in archive
      
      Example usage:
      -d switch removes fingerprints
      
      Please consider for inclusion.
      Thank you.
      
      Passive OS fingerprint homepage (archives, examples):
      http://www.ioremap.net/projects/osfSigned-off-by: default avatarEvgeniy Polyakov <zbr@ioremap.net>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      11eeef41
    • Jan Kasprzak's avatar
      netfilter: nf_ct_icmp: keep the ICMP ct entries longer · f87fb666
      Jan Kasprzak authored
      Current conntrack code kills the ICMP conntrack entry as soon as
      the first reply is received. This is incorrect, as we then see only
      the first ICMP echo reply out of several possible duplicates as
      ESTABLISHED, while the rest will be INVALID. Also this unnecessarily
      increases the conntrackd traffic on H-A firewalls.
      
      Make all the ICMP conntrack entries (including the replied ones)
      last for the default of nf_conntrack_icmp{,v6}_timeout seconds.
      Signed-off-by: default avatarJan "Yenya" Kasprzak <kas@fi.muni.cz>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      f87fb666
  2. 05 Jun, 2009 3 commits
  3. 04 Jun, 2009 1 commit
  4. 03 Jun, 2009 1 commit
    • Pablo Neira Ayuso's avatar
      netfilter: conntrack: replace notify chain by function pointer · e34d5c1a
      Pablo Neira Ayuso authored
      This patch removes the notify chain infrastructure and replace it
      by a simple function pointer. This issue has been mentioned in the
      mailing list several times: the use of the notify chain adds
      too much overhead for something that is only used by ctnetlink.
      
      This patch also changes nfnetlink_send(). It seems that gfp_any()
      returns GFP_KERNEL for user-context request, like those via
      ctnetlink, inside the RCU read-side section which is not valid.
      Using GFP_KERNEL is also evil since netlink may schedule(),
      this leads to "scheduling while atomic" bug reports.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      e34d5c1a
  5. 02 Jun, 2009 10 commits
    • Pablo Neira Ayuso's avatar
      netfilter: conntrack: simplify event caching system · 17e6e4ea
      Pablo Neira Ayuso authored
      This patch simplifies the conntrack event caching system by removing
      several events:
      
       * IPCT_[*]_VOLATILE, IPCT_HELPINFO and IPCT_NATINFO has been deleted
         since the have no clients.
       * IPCT_COUNTER_FILLING which is a leftover of the 32-bits counter
         days.
       * IPCT_REFRESH which is not of any use since we always include the
         timeout in the messages.
      
      After this patch, the existing events are:
      
       * IPCT_NEW, IPCT_RELATED and IPCT_DESTROY, that are used to identify
       addition and deletion of entries.
       * IPCT_STATUS, that notes that the status bits have changes,
       eg. IPS_SEEN_REPLY and IPS_ASSURED.
       * IPCT_PROTOINFO, that reports that internal protocol information has
       changed, eg. the TCP, DCCP and SCTP protocol state.
       * IPCT_HELPER, that a helper has been assigned or unassigned to this
       entry.
       * IPCT_MARK and IPCT_SECMARK, that reports that the mark has changed, this
       covers the case when a mark is set to zero.
       * IPCT_NATSEQADJ, to report that there's updates in the NAT sequence
       adjustment.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      17e6e4ea
    • Pablo Neira Ayuso's avatar
      netfilter: conntrack: remove events flags from userspace exposed file · 6bfea198
      Pablo Neira Ayuso authored
      This patch moves the event flags from linux/netfilter/nf_conntrack_common.h
      to net/netfilter/nf_conntrack_ecache.h. This flags are not of any use
      from userspace.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      6bfea198
    • Pablo Neira Ayuso's avatar
      netfilter: conntrack: don't report events on module removal · 274d383b
      Pablo Neira Ayuso authored
      During the module removal there are no possible event listeners
      since ctnetlink must be removed before to allow removing
      nf_conntrack. This patch removes the event reporting for the
      module removal case which is not of any use in the existing code.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      274d383b
    • Pablo Neira Ayuso's avatar
      netfilter: ctnetlink: cleanup message-size calculation · 03b64f51
      Pablo Neira Ayuso authored
      This patch cleans up the message calculation to make it similar
      to rtnetlink, moreover, it removes unneeded verbose information.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      03b64f51
    • Pablo Neira Ayuso's avatar
      netfilter: ctnetlink: use nlmsg_* helper function to build messages · 96bcf938
      Pablo Neira Ayuso authored
      Replaces the old macros to build Netlink messages with the
      new nlmsg_*() helper functions.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      96bcf938
    • Pablo Neira Ayuso's avatar
      netfilter: ctnetlink: rename tuple() by nf_ct_tuple() macro definition · f2f3e38c
      Pablo Neira Ayuso authored
      This patch move the internal tuple() macro definition to the
      header file as nf_ct_tuple().
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      f2f3e38c
    • Pablo Neira Ayuso's avatar
      netfilter: ctnetlink: remove nowait parameter from *fill_info() · 8b0a231d
      Pablo Neira Ayuso authored
      This patch is a cleanup, it removes the `nowait' parameter
      from all *fill_info() function since it is always set to one.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      8b0a231d
    • Pablo Neira Ayuso's avatar
      netfilter: nfnetlink: cleanup for nfnetlink_rcv_msg() function · f49c857f
      Pablo Neira Ayuso authored
      This patch cleans up the message handling path in two aspects:
      
       * it uses NLMSG_LENGTH() instead of NLMSG_SPACE() like rtnetlink
      does in this case to check if there is enough room for the
      Netlink/nfnetlink headers. No need to check for the padding room.
      
       * it removes a redundant header size checking that has been
       already do at the beginning of the function.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      f49c857f
    • Jozsef Kadlecsik's avatar
      netfilter: nf_ct_tcp: TCP simultaneous open support · 874ab923
      Jozsef Kadlecsik authored
      The patch below adds supporting TCP simultaneous open to conntrack. The
      unused LISTEN state is replaced by a new state (SYN_SENT2) denoting the
      second SYN sent from the reply direction in the new case. The state table
      is updated and the function tcp_in_window is modified to handle
      simultaneous open.
      
      The functionality can fairly easily be tested by socat. A sample tcpdump
      recording
      
      23:21:34.244733 IP (tos 0x0, ttl 64, id 49224, offset 0, flags [DF], proto TCP (6), length 60) 192.168.0.254.2020 > 192.168.0.1.2020: S, cksum 0xe75f (correct), 3383710133:3383710133(0) win 5840 <mss 1460,sackOK,timestamp 173445629 0,nop,wscale 7>
      23:21:34.244783 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) 192.168.0.1.2020 > 192.168.0.254.2020: R, cksum 0x0253 (correct), 0:0(0) ack 3383710134 win 0
      23:21:36.038680 IP (tos 0x0, ttl 64, id 28092, offset 0, flags [DF], proto TCP (6), length 60) 192.168.0.1.2020 > 192.168.0.254.2020: S, cksum 0x704b (correct), 2634546729:2634546729(0) win 5840 <mss 1460,sackOK,timestamp 824213 0,nop,wscale 1>
      23:21:36.038777 IP (tos 0x0, ttl 64, id 49225, offset 0, flags [DF], proto TCP (6), length 60) 192.168.0.254.2020 > 192.168.0.1.2020: S, cksum 0xb179 (correct), 3383710133:3383710133(0) ack 2634546730 win 5840 <mss 1460,sackOK,timestamp 173447423 824213,nop,wscale 7>
      23:21:36.038847 IP (tos 0x0, ttl 64, id 28093, offset 0, flags [DF], proto TCP (6), length 52) 192.168.0.1.2020 > 192.168.0.254.2020: ., cksum 0xebad (correct), ack 3383710134 win 2920 <nop,nop,timestamp 824213 173447423>
      
      and the corresponding netlink events:
      
          [NEW] tcp      6 120 SYN_SENT src=192.168.0.254 dst=192.168.0.1 sport=2020 dport=2020 [UNREPLIED] src=192.168.0.1 dst=192.168.0.254 sport=2020 dport=2020
       [UPDATE] tcp      6 120 LISTEN src=192.168.0.254 dst=192.168.0.1 sport=2020 dport=2020 src=192.168.0.1 dst=192.168.0.254 sport=2020 dport=2020
       [UPDATE] tcp      6 60 SYN_RECV src=192.168.0.254 dst=192.168.0.1 sport=2020 dport=2020 src=192.168.0.1 dst=192.168.0.254 sport=2020 dport=2020
       [UPDATE] tcp      6 432000 ESTABLISHED src=192.168.0.254 dst=192.168.0.1 sport=2020 dport=2020 src=192.168.0.1 dst=192.168.0.254 sport=2020 dport=2020 [ASSURED]
      
      The RST packet was dropped in the raw table, thus it did not reach
      conntrack.  nfnetlink_conntrack is unpatched so it shows the new SYN_SENT2
      state as the old unused LISTEN.
      
      With TCP simultaneous open support we satisfy REQ-2 in RFC 5382  ;-) .
      
      Additional minor correction in this patch is that in order to catch
      uninitialized reply directions, "td_maxwin == 0" is used instead of
      "td_end == 0" because the former can't be true except in uninitialized
      state while td_end may accidentally be equal to zero in the mid of a
      connection.
      Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      874ab923
    • Patrick McHardy's avatar
      8cc848fa
  6. 27 May, 2009 23 commits