[PATCH] New feature in Packet Filter

[J. Hellenthal]

On Thu, Apr 07, 2011 at 07:54:56PM +0200, Ermal Luçi wrote:
>On Thu, Apr 7, 2011 at 5:14 PM, Quentin Narvor <quentin.narvor at gmail.com> wrote:
>> 2011/4/7 Ermal Luçi <eri at freebsd.org>
>>
>>> On Thu, Apr 7, 2011 at 10:21 AM, Quentin Narvor
>>> <quentin.narvor at gmail.com> wrote:
>>> > Hello,
>>> >
>>> > My name is Quentin Narvor and I am currently working on intrusion
>>> detection.
>>> > I use Freebsd 8.2 and I recently needed pf to be able to dynamically fill
>>> in
>>> > tables according pass rule.
>>> >
>>> > For performances reasons, I didn't want to do it with a script and pfctl.
>>> > Then, with the help of Mr Nicolas Greneche, I made this patch named
>>> "add".
>>> > It enables pf to add src ip or dst ip in a table when a match occurs on a
>>> > pass rule.
>>> >
>>>
>>> I cannot see, apart collecting ips in tables, anything else that
>>> cannot be done through pf(4) tags!
>>> Can you please describe a use case for this patch?
>>
>>
>> Indeed, it enables pf to change its behaviour toward some hosts dynamically.
>> I will build a blacklist of ip which have been recognized as compromized
>> (botnets, spam, etc). I build a table with thoses IP.
>>
>> If I match a connection between one host of my internal network and one
>> blacklisted ip, there are chances that this host is infected.
>> I want to do a comprehensive capture of this host connections by adding src
>> ip to a table of hosts to watch. A dup-to rule dump traffic from "host to
>> watch" table to a sensor.
>>
>> Here are the rules :
>> pass in on $int_if from any to <blacklist> add ipsrc <infected_hosts>
>> pass in on $int_if dup-to ($sensor_if, sensor_ip) from <infected_hosts> to
>> any
>
>Hmm, the below should work.
>
>.....
>pass in on $int_if from any to <blacklist> tag SUSPECT
>pass in on $int_if dup-to ($sensor_if, sensor_ip) from all tagged SUSPECT
>.....

Source connection tracking would probably also work here too but unless
you are planning on filling up RAM per table usage I would certainly
suggest using tagging.

An example of what I use for src connection tracking that overloads to a
blacklist would be one for SSH logins.

pass in log quick proto tcp from !<trusted> port >1023 to any port
$shports label "Login/SSH:$dstport" keep state (max-src-conn 5,
max-src-conn-rate 15/30 overload <blacklist> flush global)

But this may not be exactly what your looking for even though it could
be tricked out to put every IP into a table but like I said your going
to be filling up some RAM fairly quickly by keeping those hosts in a
table depending on how often your rule is going to match.

>
>
>>
>> Unless I miss something, I think it is not possible to make this example
>> just with pf(4) tags : it would have been possible if I wanted to copy only
>> the traffic between my hosts and botnets.
>>
>>
>>> > I submit this patch to your attention. Is this feature is of interest to
>>> be
>>> > added in PF mainstream ?
>>> >
>>> > You will find the patch and its documentation in attachment.
>>> > Let me know if you think that some modifications are needed.
>>> >
>>>
>

-- 

 J. Hellenthal

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 522 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20110407/d51f92ba/attachment.pgp