Breakpointing-Bad-Public
/
112-hackathon
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Browse Source

added base to new conntrack helper

master
Beau Kujath 3 years ago
parent
9a4b3d9270
commit
424491d8cd
7 changed files with 243 additions and 363 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 2
      src/dns_lkm/Makefile
  2. 20
      src/dns_lkm/add_conn_rules.sh
  3. 12
      src/dns_lkm/delete_conn_rules.sh
  4. 8
      src/dns_lkm/enable_helper.sh
  5. 196
      src/dns_lkm/nf_conntrack_sdns.c
  6. 6
      src/dns_lkm/test_pings.sh
  7. 362
      src/nf_conntrack_dns.c

2
src/dns_lkm/Makefile
View File

@ -1,5 +1,5 @@
obj-m := LKM.o
LKM-objs += netfilter_LKM.o
LKM-objs += nf_conntrack_sdns.o
all:
sudo make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

20
src/dns_lkm/add_conn_rules.sh
View File

@ -0,0 +1,20 @@
#!/bin/bash
#
printf "Adding iptables rules to track dns stuff..\n"
sudo iptables -A PREROUTING -t raw -p udp --dport 53 -d 8.8.8.8 -j CT --helper sdns
sudo iptables -A OUTPUT -t raw -p udp --dport 53 -d 8.8.8.8 -j CT --helper sdns
sudo iptables -A PREROUTING -t raw -p udp --sport 53 -s 8.8.8.8 -j CT --helper sdns
sudo iptables -A OUTPUT -t raw -p udp --sport 53 -s 8.8.8.8 -j CT --helper sdns
# sudo nping --tcp --dest-ip 1.2.3.4 -p 40404 --data-string "blahblah"

12
src/dns_lkm/delete_conn_rules.sh
View File

@ -0,0 +1,12 @@
#!/bin/bash
#
printf "Removing iptables rules to track dns stuff..\n"
sudo iptables -D PREROUTING -t raw -p udp --dport 53 -d 8.8.8.8 -j CT --helper sdns
sudo iptables -D OUTPUT -t raw -p udp --dport 53 -d 8.8.8.8 -j CT --helper sdns
sudo iptables -D PREROUTING -t raw -p udp --sport 53 -s 8.8.8.8 -j CT --helper sdns
sudo iptables -D OUTPUT -t raw -p udp --sport 53 -s 8.8.8.8 -j CT --helper sdns

8
src/dns_lkm/enable_helper.sh
View File

@ -0,0 +1,8 @@
#!/bin/bash
#
sudo modprobe nf_conntrack nf_conntrack_helper
sudo sysctl net.netfilter.nf_conntrack_helper
# sudo iptables -A PREROUTING -t raw -p tcp --dport 2121 -d 1.2.3.4 -j CT --helper testo

196
src/dns_lkm/nf_conntrack_sdns.c
View File

@ -0,0 +1,196 @@
/* SDNS extension for IP connection tracking
* (C) 2021 by Beau Kujath <beau@breakpointingbad.com>
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/skbuff.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/netfilter.h>
#include <linux/slab.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <linux/netfilter/nf_conntrack_irc.h>
#define MAX_PORTS 8
static unsigned short ports[MAX_PORTS];
static unsigned int ports_c;
static char *sdns_buffer;
//static DEFINE_SPINLOCK(nf_sdns_lock);
struct dnsinfo {
__be16 txid;
};
struct nf_ct_sdns_master {
unsigned int txid;
/* Valid seq positions for cmd matching after newline */
//u_int32_t seq_aft_nl[IP_CT_DIR_MAX][NUM_SEQ_TO_REMEMBER];
/* 0 means seq_match_aft_nl not set */
//u_int16_t seq_aft_nl_num[IP_CT_DIR_MAX];
/* pickup sequence tracking, useful for conntrackd */
//u_int16_t flags[IP_CT_DIR_MAX];
};
unsigned int (*nf_nat_sdns_hook)(struct sk_buff *skb,
enum ip_conntrack_info ctinfo,
unsigned int protoff,
unsigned int matchoff,
unsigned int matchlen,
struct nf_conntrack_expect *exp) __read_mostly;
EXPORT_SYMBOL_GPL(nf_nat_sdns_hook);
#define HELPER_NAME "sdns"
MODULE_AUTHOR("Beau Kujath <beau@breakpointingbad.com>");
MODULE_DESCRIPTION("sdns connection tracking helper");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ip_conntrack_sdns");
MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
module_param_array(ports, ushort, &ports_c, 0400);
MODULE_PARM_DESC(ports, "port numbers of dns servers");
static int help(struct sk_buff *skb, unsigned int protoff,
struct nf_conn *ct, enum ip_conntrack_info ctinfo)
{
struct udphdr _udph;
struct dnsinfo _dnsi;
const struct dnsinfo *dnsi;
unsigned int dataoff, datalimit;
struct nf_ct_sdns_master *ct_sdns_info = nfct_help_data(ct);
struct udphdr *uh = skb_header_pointer(skb, protoff, sizeof(_udph), &_udph);
printk(KERN_INFO "\ntriggering conntrack sdns helper function\n");
//int dport = ntohs(uh->dest);
//printk(KERN_INFO "original protoff: (%u), len: (%u)\n", protoff, sizeof(_udph));
//printk(KERN_INFO "dst port for packet: %u\n", dport);
if (uh == NULL)
return NF_ACCEPT;
dataoff = protoff + sizeof(struct udphdr);
datalimit = dataoff + sizeof(struct dnsinfo);
// could probably delete this if check
if (dataoff >= skb->len) {
pr_debug("sdns: dataoff(%u) >= skblen(%u)\n", dataoff,
skb->len);
return NF_ACCEPT;
}
if (datalimit >= skb->len) {
pr_debug("sdns: datalimit(%u) >= skblen(%u)\n", datalimit,
skb->len);
return NF_ACCEPT;
}
dnsi = skb_header_pointer(skb, dataoff,
sizeof(_dnsi), &_dnsi);
if (dnsi == NULL)
return NF_ACCEPT;
//printk(KERN_INFO "ctinfo val: %d\n", ctinfo);
if (ctinfo == IP_CT_NEW) {
// keep track of txid if it is new entry
int txid = ntohs(dnsi->txid);
ct_sdns_info->txid = txid;
printk(KERN_INFO "tracking txid for new ct entry: %d\n", ct_sdns_info->txid);
} else if (ctinfo == IP_CT_IS_REPLY) {
// check the txid of reply on reply entry
int txid = ntohs(dnsi->txid);
printk(KERN_INFO "dns txid of reply: %d, dns txid stored in ct struct: %d \n", txid, ct_sdns_info->txid);
if (txid == ct_sdns_info->txid) {
printk(KERN_INFO "yes, txid on reply matched so accept!");
return NF_ACCEPT;
} else {
printk(KERN_INFO "WARNING, txid on reply did not match so removing ct entry!");
nf_ct_delete(ct, 0, 0);
return NF_DROP;
}
}
return NF_ACCEPT;
}
static struct nf_conntrack_helper sdns[MAX_PORTS] __read_mostly;
static struct nf_conntrack_expect_policy sdns_exp_policy;
static int __init nf_conntrack_sdns_init(void)
{
int i, ret;
printk(KERN_INFO "initializing conntrack sdns helper\n");
sdns_buffer = kmalloc(65536, GFP_KERNEL);
if (!sdns_buffer)
return -ENOMEM;
/* If no port given, default to standard sdns port */
if (ports_c == 0) {
printk(KERN_INFO "no ports given so assigning default port\n");
ports[ports_c++] = IRC_PORT;
}
for (i = 0; i < ports_c; i++) {
nf_ct_helper_init(&sdns[i], AF_INET, IPPROTO_UDP, HELPER_NAME,
IRC_PORT, ports[i], i, &sdns_exp_policy,
0, help, NULL, THIS_MODULE);
}
ret = nf_conntrack_helpers_register(&sdns[0], ports_c);
if (ret) {
pr_err("failed to register helpers\n");
kfree(sdns_buffer);
return ret;
}
return 0;
}
static void __exit nf_conntrack_sdns_fini(void)
{
nf_conntrack_helpers_unregister(sdns, ports_c);
kfree(sdns_buffer);
}
module_init(nf_conntrack_sdns_init);
module_exit(nf_conntrack_sdns_fini);

6
src/dns_lkm/test_pings.sh
View File

@ -0,0 +1,6 @@
#!/bin/bash
#
nslookup yo.com 8.8.8.8

362
src/nf_conntrack_dns.c
View File

@ -1,362 +0,0 @@
// SPDX-License-Identifier: GPL-2.0-only
/* DNS extension for connection tracking. */
// CODE is based on the FTP connection tracking module.
/* (C) 2021-20XX Benjamin Mixon-Baca
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/netfilter.h>
#include <linux/ip.h>
#include <linux/slab.h>
#include <linux/ipv6.h>
#include <linux/ctype.h>
#include <linux/inet.h>
#include <net/checksum.h>
#include <net/udp.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_helper.h>
// #include <linux/netfilter/nf_conntrack_ftp.h>
#define HELPER_NAME "dns"
MODULE_LICENSE("GPL");
MODULE_AUTHOR("ben@breakpointingbad.com>");
MODULE_DESCRIPTION("dns connection tracking helper");
MODULE_ALIAS("ip_conntrack_dns");
MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
/* This is slow, but it's simple. --RR */
static char *dns_buffer;
/*BEN: Hug, we might need to use locks*/
static DEFINE_SPINLOCK(nf_dns_lock);
#define DNS_PORT 53
#define MAX_PORTS 8 // Rip this from FTP module
static u_int16_t dns_ports[MAX_PORTS];
static unsigned int dns_ports_c;
module_param_array(dns_ports, ushort, &dns_ports_c, 0400);
static bool loose;
module_param(loose, bool, 0600);
unsigned int (*nf_nat_dns_hook)(struct sk_buff *skb,
enum ip_conntrack_info ctinfo,
enum nf_ct_ftp_type type,
unsigned int protoff,
unsigned int matchoff,
unsigned int matchlen,
struct nf_conntrack_expect *exp);
EXPORT_SYMBOL_GPL(nf_nat_dns_hook);
static int try_rfc959(const char *, size_t, struct nf_conntrack_man *,
char, unsigned int *);
static int try_rfc1123(const char *, size_t, struct nf_conntrack_man *,
char, unsigned int *);
static int try_eprt(const char *, size_t, struct nf_conntrack_man *,
char, unsigned int *);
static int try_epsv_response(const char *, size_t, struct nf_conntrack_man *,
char, unsigned int *);
static struct ftp_search {
const char *pattern;
size_t plen;
char skip;
char term;
enum nf_ct_ftp_type ftptype;
int (*getnum)(const char *, size_t, struct nf_conntrack_man *, char, unsigned int *);
} search[IP_CT_DIR_MAX][2] = {
[IP_CT_DIR_ORIGINAL] = {
{
.pattern = "PORT",
.plen = sizeof("PORT") - 1,
.skip = ' ',
.term = '\r',
.ftptype = NF_CT_FTP_PORT,
.getnum = try_rfc959,
},
{
.pattern = "EPRT",
.plen = sizeof("EPRT") - 1,
.skip = ' ',
.term = '\r',
.ftptype = NF_CT_FTP_EPRT,
.getnum = try_eprt,
},
},
[IP_CT_DIR_REPLY] = {
{
.pattern = "227 ",
.plen = sizeof("227 ") - 1,
.ftptype = NF_CT_FTP_PASV,
.getnum = try_rfc1123,
},
{
.pattern = "229 ",
.plen = sizeof("229 ") - 1,
.skip = '(',
.term = ')',
.ftptype = NF_CT_FTP_EPSV,
.getnum = try_epsv_response,
},
},
};
static int
get_ipv6_addr(const char *src, size_t dlen, struct in6_addr *dst, u_int8_t term)
{
const char *end;
int ret = in6_pton(src, min_t(size_t, dlen, 0xffff), (u8 *)dst, term, &end);
if (ret > 0)
return (int)(end - src);
return 0;
}
static int try_number(const char *data, size_t dlen, u_int32_t array[],
int array_size, char sep, char term)
{
u_int32_t i, len;
memset(array, 0, sizeof(array[0])*array_size);
/* Keep data pointing at next char. */
for (i = 0, len = 0; len < dlen && i < array_size; len++, data++) {
if (*data >= '0' && *data <= '9') {
array[i] = array[i]*10 + *data - '0';
}
else if (*data == sep)
i++;
else {
/* Unexpected character; true if it's the
terminator (or we don't care about one)
and we're finished. */
if ((*data == term || !term) && i == array_size - 1)
return len;
pr_debug("Char %u (got %u nums) `%u' unexpected\n",
len, i, *data);
return 0;
}
}
pr_debug("Failed to fill %u numbers separated by %c\n",
array_size, sep);
return 0;
}
/* Returns 0, or length of numbers: 192,168,1,1,5,6 */
static int try_rfc959(const char *data, size_t dlen,
struct nf_conntrack_man *cmd, char term,
unsigned int *offset)
{
int length;
u_int32_t array[6];
length = try_number(data, dlen, array, 6, ',', term);
if (length == 0)
return 0;
cmd->u3.ip = htonl((array[0] << 24) | (array[1] << 16) |
(array[2] << 8) | array[3]);
cmd->u.udp.port = htons((array[4] << 8) | array[5]);
return length;
}
/*
* From RFC 1123:
* The format of the 227 reply to a PASV command is not
* well standardized. In particular, an FTP client cannot
* assume that the parentheses shown on page 40 of RFC-959
* will be present (and in fact, Figure 3 on page 43 omits
* them). Therefore, a User-FTP program that interprets
* the PASV reply must scan the reply for the first digit
* of the host and port numbers.
*/
static int try_rfc1123(const char *data, size_t dlen,
struct nf_conntrack_man *cmd, char term,
unsigned int *offset)
{
int i;
for (i = 0; i < dlen; i++)
if (isdigit(data[i]))
break;
if (i == dlen)
return 0;
*offset += i;
return try_rfc959(data + i, dlen - i, cmd, 0, offset);
}
/* Grab port: number up to delimiter */
static int get_port(const char *data, int start, size_t dlen, char delim,
__be16 *port)
{
u_int16_t tmp_port = 0;
int i;
for (i = start; i < dlen; i++) {
/* Finished? */
if (data[i] == delim) {
if (tmp_port == 0)
break;
*port = htons(tmp_port);
pr_debug("get_port: return %d\n", tmp_port);
return i + 1;
}
else if (data[i] >= '0' && data[i] <= '9')
tmp_port = tmp_port*10 + data[i] - '0';
else { /* Some other crap */
pr_debug("get_port: invalid char.\n");
break;
}
}
return 0;
}
/* Returns 0, or length of numbers: |1|132.235.1.2|6275| or |2|3ffe::1|6275| */
static int try_eprt(const char *data, size_t dlen, struct nf_conntrack_man *cmd,
char term, unsigned int *offset)
{
char delim;
int length;
/* First character is delimiter, then "1" for IPv4 or "2" for IPv6,
then delimiter again. */
if (dlen <= 3) {
pr_debug("EPRT: too short\n");
return 0;
}
delim = data[0];
if (isdigit(delim) || delim < 33 || delim > 126 || data[2] != delim) {
pr_debug("try_eprt: invalid delimiter.\n");
return 0;
}
if ((cmd->l3num == PF_INET && data[1] != '1') ||
(cmd->l3num == PF_INET6 && data[1] != '2')) {
pr_debug("EPRT: invalid protocol number.\n");
return 0;
}
pr_debug("EPRT: Got %c%c%c\n", delim, data[1], delim);
if (data[1] == '1') {
u_int32_t array[4];
/* Now we have IP address. */
length = try_number(data + 3, dlen - 3, array, 4, '.', delim);
if (length != 0)
cmd->u3.ip = htonl((array[0] << 24) | (array[1] << 16)
| (array[2] << 8) | array[3]);
} else {
/* Now we have IPv6 address. */
length = get_ipv6_addr(data + 3, dlen - 3,
(struct in6_addr *)cmd->u3.ip6, delim);
}
if (length == 0)
return 0;
pr_debug("EPRT: Got IP address!\n");
/* Start offset includes initial "|1|", and trailing delimiter */
return get_port(data, 3 + length + 1, dlen, delim, &cmd->u.udp.port);
}
/* Returns 0, or length of numbers: |||6446| */
static int try_epsv_response(const char *data, size_t dlen,
struct nf_conntrack_man *cmd, char term,
unsigned int *offset)
{
char delim;
/* Three delimiters. */
if (dlen <= 3) return 0;
delim = data[0];
if (isdigit(delim) || delim < 33 || delim > 126 ||
data[1] != delim || data[2] != delim)
return 0;
uh = skb_header_pointer(skb, protoff, sizeof(_udph), &_udph);
if (uh == NULL)
return NF_ACCEPT;
// BEN: Where is the data offset here?
dataoff = 4 * 16; // UDP is 4 2-byte chunks, then comes the payload
/* No data? */
if (dataoff >= skb->len) {
pr_debug("dns: dataoff(%u) >= skblen(%u)\n", dataoff,
skb->len);
return NF_ACCEPT;
}
datalen = skb->len - dataoff;
spin_lock_bh(&nf_dns_lock);
dns_ptr = skb_header_pointer(skb, dataoff, datalen,
dns_buffer);
if (!dns_ptr) {
spin_unlock_bh(&nf_dns_lock);
return NF_ACCEPT;
}
out:
spin_unlock_bh(&nf_dns_lock);
return ret;
}
static struct nf_conntrack_helper dns[MAX_PORTS * 2] __read_mostly;
static const struct nf_conntrack_expect_policy dns_exp_policy = {
.max_expected = 1,
.timeout = 5 * 60,
};
static void __exit nf_conntrack_ftp_fini(void)
{
nf_conntrack_helpers_unregister(dns, dns_ports_c * 2);
kfree(dns_buffer);
}
static int __init nf_conntrack_dns_init(void)
{
int i, ret = 0;
// NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_ftp_master));
dns_buffer = kmalloc(65536, GFP_KERNEL);
if (!dns_buffer)
return -ENOMEM;
if (dns_ports_c == 0)
dns_ports[dns_ports_c++] = DNS_PORT;
/* FIXME should be configurable whether IPv4 and IPv6 FTP connections
are tracked or not - YK */
for (i = 0; i < dns_ports_c; i++) {
nf_ct_helper_init(&ftp[2 * i], AF_INET, IPPROTO_UDP,
HELPER_NAME, DNS_PORT, dns_ports[i], ports[i],
&dns_exp_policy, 0, help,
nf_ct_ftp_from_nlattr, THIS_MODULE);
nf_ct_helper_init(&ftp[2 * i + 1], AF_INET6, IPPROTO_UDP,
HELPER_NAME, DNS_PORT, dns_ports[i], ports[i],
&dns_exp_policy, 0, help,
nf_ct_ftp_from_nlattr, THIS_MODULE);
}
ret = nf_conntrack_helpers_register(dns, dns_ports_c * 2);
if (ret < 0) {
pr_err("failed to register helpers\n");
kfree(dns_buffer);
return ret;
}
return 0;
}
module_init(nf_conntrack_dns_init);
module_exit(nf_conntrack_dns_fini);
Write Preview
Loading…
Cancel
Save