extensions/xt_TARPIT.c

   1 /*
   2  *      "TARPIT" target extension to Xtables
   3  *      Kernel module to capture and hold incoming TCP connections using
   4  *      no local per-connection resources.
   5  *
   6  *      Copyright © Aaron Hopkins <tools [at] die net>, 2002
   7  *
   8  *      Based on ipt_REJECT.c and offering functionality similar to
   9  *      LaBrea <http://www.hackbusters.net/LaBrea/>.
  10  *
  11  *      <<<
  12  *      This program is free software; you can redistribute it and/or modify
  13  *      it under the terms of the GNU General Public License as published by
  14  *      the Free Software Foundation; either version 2 of the License, or
  15  *      (at your option) any later version.
  16  *
  17  *      This program is distributed in the hope that it will be useful,
  18  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  *      GNU General Public License for more details.
  21  *
  22  *      You should have received a copy of the GNU General Public License
  23  *      along with this program; if not, write to the Free Software
  24  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  25  *      >>>
  26  *
  27  * Goal:
  28  * - Allow incoming TCP connections to be established.
  29  * - Passing data should result in the connection being switched to the
  30  *   persist state (0 byte window), in which the remote side stops sending
  31  *   data and asks to continue every 60 seconds.
  32  * - Attempts to shut down the connection should be ignored completely, so
  33  *   the remote side ends up having to time it out.
  34  *
  35  * This means:
  36  * - Reply to TCP SYN,!ACK,!RST,!FIN with SYN-ACK, window 5 bytes
  37  * - Reply to TCP SYN,ACK,!RST,!FIN with RST to prevent spoofing
  38  * - Reply to TCP !SYN,!RST,!FIN with ACK, window 0 bytes, rate-limited
  39  */
  40
  41 #include <linux/ip.h>
  42 #include <linux/module.h>
  43 #include <linux/skbuff.h>
  44 #include <linux/version.h>
  45 #include <linux/netfilter_ipv6.h>
  46 #include <linux/netfilter/x_tables.h>
  47 #ifdef CONFIG_BRIDGE_NETFILTER
  48 #       include <linux/netfilter_bridge.h>
  49 #endif
  50 #include <net/addrconf.h>
  51 #include <net/ip6_checksum.h>
  52 #include <net/ip6_route.h>
  53 #include <net/ipv6.h>
  54 #include <net/route.h>
  55 #include <net/tcp.h>
  56 #include "compat_xtables.h"
  57 #include "xt_TARPIT.h"
  58 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
  59 #       define WITH_IPV6 1
  60 #endif
  61
  62 static bool xttarpit_tarpit(struct tcphdr *tcph, const struct tcphdr *oth)
  63 {
  64         /* No replies for RST, FIN or !SYN,!ACK */
  65         if (oth->rst || oth->fin || (!oth->syn && !oth->ack))
  66                 return false;
  67         tcph->seq = oth->ack ? oth->ack_seq : 0;
  68
  69         /* Our SYN-ACKs must have a >0 window */
  70         tcph->window = (oth->syn && !oth->ack) ? htons(5) : 0;
  71         if (oth->syn && oth->ack) {
  72                 tcph->rst     = true;
  73                 tcph->ack_seq = false;
  74         } else {
  75                 tcph->syn     = oth->syn;
  76                 tcph->ack     = true;
  77                 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn);
  78         }
  79 #if 0
  80         /* Rate-limit replies to !SYN,ACKs */
  81         if (!oth->syn && oth->ack)
  82                 if (!xrlim_allow(&ort->dst, HZ))
  83                         return false;
  84 #endif
  85
  86         return true;
  87 }
  88
  89 static bool xttarpit_honeypot(struct tcphdr *tcph, const struct tcphdr *oth,
  90     uint16_t payload)
  91 {
  92         /* Do not answer any resets regardless of combination */
  93         if (oth->rst || oth->seq == 0xDEADBEEF)
  94                 return false;
  95         /* Send a reset to scanners. They like that. */
  96         if (oth->syn && oth->ack) {
  97                 tcph->window  = 0;
  98                 tcph->ack     = false;
  99                 tcph->psh     = true;
 100                 tcph->ack_seq = 0xdeadbeef; /* see if they ack it */
 101                 tcph->seq     = oth->ack_seq;
 102                 tcph->rst     = true;
 103         }
 104
 105         /* SYN > SYN-ACK */
 106         if (oth->syn && !oth->ack) {
 107                 tcph->syn     = true;
 108                 tcph->ack     = true;
 109                 tcph->window  = oth->window &
 110                         ((prandom_u32() & 0x1f) - 0xf);
 111                 tcph->seq     = htonl(prandom_u32() & ~oth->seq);
 112                 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn);
 113         }
 114
 115         /* ACK > ACK */
 116         if (oth->ack && (!(oth->fin || oth->syn))) {
 117                 tcph->syn     = false;
 118                 tcph->ack     = true;
 119                 tcph->window  = oth->window &
 120                         ((prandom_u32() & 0x1f) - 0xf);
 121                 tcph->ack_seq = payload > 100 ?
 122                         htonl(ntohl(oth->seq) + payload) :
 123                         oth->seq;
 124                 tcph->seq     = oth->ack_seq;
 125         }
 126
 127         /*
 128          * FIN > RST.
 129          * We cannot terminate gracefully so just be abrupt.
 130          */
 131         if (oth->fin) {
 132                 tcph->window  = 0;
 133                 tcph->seq     = oth->ack_seq;
 134                 tcph->ack_seq = oth->ack_seq;
 135                 tcph->fin     = false;
 136                 tcph->ack     = false;
 137                 tcph->rst     = true;
 138         }
 139
 140         return true;
 141 }
 142
 143 static void xttarpit_reset(struct tcphdr *tcph, const struct tcphdr *oth)
 144 {
 145         tcph->window  = 0;
 146         tcph->ack     = false;
 147         tcph->syn     = false;
 148         tcph->rst     = true;
 149         tcph->seq     = oth->ack_seq;
 150         tcph->ack_seq = oth->seq;
 151 }
 152
 153 static bool tarpit_generic(struct tcphdr *tcph, const struct tcphdr *oth,
 154     uint16_t payload, unsigned int mode)
 155 {
 156         switch(mode) {
 157         case XTTARPIT_TARPIT:
 158                 if (!xttarpit_tarpit(tcph, oth))
 159                         return false;
 160                 break;
 161         case XTTARPIT_HONEYPOT:
 162                 if (!xttarpit_honeypot(tcph, oth, payload))
 163                         return false;
 164                 break;
 165         case XTTARPIT_RESET:
 166                 xttarpit_reset(tcph, oth);
 167                 break;
 168         }
 169
 170         return true;
 171 }
 172
 173 static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 174     unsigned int hook, unsigned int mode)
 175 {
 176         struct tcphdr _otcph, *tcph;
 177         const struct tcphdr *oth;
 178         unsigned int addr_type = RTN_UNSPEC;
 179         struct sk_buff *nskb;
 180         const struct iphdr *oldhdr;
 181         struct iphdr *niph;
 182         uint16_t tmp, payload;
 183
 184         /* A truncated TCP header is not going to be useful */
 185         if (oldskb->len < ip_hdrlen(oldskb) + sizeof(struct tcphdr))
 186                 return;
 187
 188         oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
 189                                  sizeof(_otcph), &_otcph);
 190         if (oth == NULL)
 191                 return;
 192
 193         /* Check checksum. */
 194         if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
 195                 return;
 196
 197         /*
 198          * Copy skb (even if skb is about to be dropped, we cannot just
 199          * clone it because there may be other things, such as tcpdump,
 200          * interested in it)
 201          */
 202         nskb = skb_copy_expand(oldskb, LL_MAX_HEADER,
 203                                skb_tailroom(oldskb), GFP_ATOMIC);
 204         if (nskb == NULL)
 205                 return;
 206
 207         /* This packet will not be the same as the other: clear nf fields */
 208 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
 209         nf_reset_ct(nskb);
 210 #else
 211         nf_reset(nskb);
 212 #endif
 213         skb_nfmark(nskb) = 0;
 214         skb_init_secmark(nskb);
 215         skb_shinfo(nskb)->gso_size = 0;
 216         skb_shinfo(nskb)->gso_segs = 0;
 217         skb_shinfo(nskb)->gso_type = 0;
 218         oldhdr = ip_hdr(oldskb);
 219         tcph = (struct tcphdr *)(skb_network_header(nskb) + ip_hdrlen(nskb));
 220
 221         /* Swap source and dest */
 222         niph         = ip_hdr(nskb);
 223         niph->daddr  = xchg(&niph->saddr, niph->daddr);
 224         tmp          = tcph->source;
 225         tcph->source = tcph->dest;
 226         tcph->dest   = tmp;
 227
 228         /* Calculate payload size?? */
 229         payload = nskb->len - ip_hdrlen(nskb) - sizeof(struct tcphdr);
 230
 231         /* Truncate to length (no data) */
 232         tcph->doff    = sizeof(struct tcphdr) / 4;
 233         skb_trim(nskb, ip_hdrlen(nskb) + sizeof(struct tcphdr));
 234         niph->tot_len = htons(nskb->len);
 235         tcph->urg_ptr = 0;
 236         /* Reset flags */
 237         ((u_int8_t *)tcph)[13] = 0;
 238
 239         if (!tarpit_generic(tcph, oth, payload, mode))
 240                 goto free_nskb;
 241
 242         /* Adjust TCP checksum */
 243         tcph->check = 0;
 244         tcph->check = tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
 245                       niph->daddr, csum_partial((char *)tcph,
 246                       sizeof(struct tcphdr), 0));
 247
 248         /* Set DF, id = 0 */
 249         niph->frag_off = htons(IP_DF);
 250         if (mode == XTTARPIT_TARPIT || mode == XTTARPIT_RESET)
 251                 niph->id = 0;
 252         else if (mode == XTTARPIT_HONEYPOT)
 253                 niph->id = ~oldhdr->id + 1;
 254
 255 #ifdef CONFIG_BRIDGE_NETFILTER
 256 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
 257         if (hook != NF_INET_FORWARD || ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF) != NULL &&
 258             ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF))->physoutdev))
 259 #else
 260         if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
 261             nskb->nf_bridge->physoutdev != NULL))
 262 #endif
 263 #else
 264         if (hook != NF_INET_FORWARD)
 265 #endif
 266                 addr_type = RTN_LOCAL;
 267
 268         if (ip_route_me_harder(net, nskb, addr_type))
 269                 goto free_nskb;
 270         else
 271                 niph = ip_hdr(nskb);
 272
 273         nskb->ip_summed = CHECKSUM_NONE;
 274
 275         /* Adjust IP TTL */
 276         if (mode == XTTARPIT_HONEYPOT)
 277                 niph->ttl = 128;
 278         else
 279                 niph->ttl = ip4_dst_hoplimit(skb_dst(nskb));
 280
 281         /* Adjust IP checksum */
 282         niph->check = 0;
 283         niph->check = ip_fast_csum(skb_network_header(nskb), niph->ihl);
 284
 285         /* "Never happens" */
 286         if (nskb->len > dst_mtu(skb_dst(nskb)))
 287                 goto free_nskb;
 288
 289         nf_ct_attach(nskb, oldskb);
 290         NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, nskb->sk, nskb, NULL,
 291                 skb_dst(nskb)->dev, dst_output);
 292         return;
 293
 294  free_nskb:
 295         kfree_skb(nskb);
 296 }
 297
 298 #ifdef WITH_IPV6
 299 static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
 300     unsigned int hook, unsigned int mode)
 301 {
 302         struct sk_buff *nskb;
 303         struct tcphdr *tcph, oth;
 304         unsigned int otcplen;
 305         int tcphoff;
 306         const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
 307         struct ipv6hdr *ip6h;
 308         const uint8_t tclass = 0;
 309         uint8_t proto;
 310         uint16_t payload;
 311         __be16 frag_off;
 312
 313         proto   = oip6h->nexthdr;
 314         tcphoff = ipv6_skip_exthdr(oldskb,
 315                   (uint8_t *)(oip6h + 1) - oldskb->data, &proto, &frag_off);
 316
 317         if (tcphoff < 0 || tcphoff > oldskb->len) {
 318                 pr_debug("Cannot get TCP header.\n");
 319                 return;
 320         }
 321
 322         otcplen = oldskb->len - tcphoff;
 323
 324         /* IP header checks: fragment, too short. */
 325         if (proto != IPPROTO_TCP || otcplen < sizeof(struct tcphdr)) {
 326                 pr_debug("proto(%d) != IPPROTO_TCP, "
 327                          "or too short. otcplen = %d\n",
 328                          proto, otcplen);
 329                 return;
 330         }
 331
 332         if (skb_copy_bits(oldskb, tcphoff, &oth, sizeof(struct tcphdr))) {
 333                 WARN_ON(1);
 334                 return;
 335         }
 336
 337         /* Check checksum. */
 338         if (csum_ipv6_magic(&oip6h->saddr, &oip6h->daddr, otcplen, IPPROTO_TCP,
 339             skb_checksum(oldskb, tcphoff, otcplen, 0))) {
 340                 pr_debug("TCP checksum is invalid\n");
 341                 return;
 342         }
 343
 344         nskb = skb_copy_expand(oldskb, LL_MAX_HEADER,
 345                skb_tailroom(oldskb), GFP_ATOMIC);
 346         if (nskb == NULL) {
 347                 if (net_ratelimit())
 348                         pr_debug("cannot alloc skb\n");
 349                 return;
 350         }
 351
 352         /* This packet will not be the same as the other: clear nf fields */
 353 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
 354         nf_reset_ct(nskb);
 355 #else
 356         nf_reset(nskb);
 357 #endif
 358         skb_nfmark(nskb) = 0;
 359         skb_init_secmark(nskb);
 360         skb_shinfo(nskb)->gso_size = 0;
 361         skb_shinfo(nskb)->gso_segs = 0;
 362         skb_shinfo(nskb)->gso_type = 0;
 363         skb_put(nskb, sizeof(struct ipv6hdr));
 364         ip6h = ipv6_hdr(nskb);
 365         *(__be32 *)ip6h =  htonl(0x60000000 | (tclass << 20));
 366         ip6h->nexthdr = IPPROTO_TCP;
 367         ip6h->saddr = oip6h->daddr;
 368         ip6h->daddr = oip6h->saddr;
 369
 370         /* Adjust IP TTL */
 371         if (mode == XTTARPIT_HONEYPOT) {
 372                 ip6h->hop_limit = 128;
 373         } else {
 374                 ip6h->hop_limit = ip6_dst_hoplimit(skb_dst(nskb));
 375         }
 376
 377         tcph = (struct tcphdr *)(skb_network_header(nskb) +
 378                sizeof(struct ipv6hdr));
 379
 380         /* Truncate to length (no data) */
 381         skb_trim(nskb, sizeof(struct ipv6hdr) + sizeof(struct tcphdr));
 382         tcph->doff    = sizeof(struct tcphdr)/4;
 383         tcph->source  = oth.dest;
 384         tcph->dest    = oth.source;
 385         tcph->urg_ptr = 0;
 386         /* Reset flags */
 387         ((uint8_t *)tcph)[13] = 0;
 388
 389         payload = nskb->len - sizeof(struct ipv6hdr) - sizeof(struct tcphdr);
 390         if (!tarpit_generic(&oth, tcph, payload, mode))
 391                 goto free_nskb;
 392
 393         ip6h->payload_len = htons(sizeof(struct tcphdr));
 394         tcph->check = 0;
 395
 396         /* Adjust TCP checksum */
 397         tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr,
 398                       &ipv6_hdr(nskb)->daddr, sizeof(struct tcphdr),
 399                       IPPROTO_TCP,
 400                       csum_partial(tcph, sizeof(struct tcphdr), 0));
 401
 402         if (ip6_route_me_harder(net, nskb))
 403                 goto free_nskb;
 404
 405         nskb->ip_summed = CHECKSUM_NONE;
 406
 407         nf_ct_attach(nskb, oldskb);
 408         NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, nskb->sk, nskb, NULL,
 409                 skb_dst(nskb)->dev, dst_output);
 410         return;
 411
 412  free_nskb:
 413         kfree_skb(nskb);
 414 }
 415 #endif
 416
 417 static unsigned int
 418 tarpit_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 419 {
 420         const struct iphdr *iph = ip_hdr(skb);
 421         const struct rtable *rt = skb_rtable(skb);
 422         const struct xt_tarpit_tginfo *info = par->targinfo;
 423
 424         /* Do we have an input route cache entry? (Not in PREROUTING.) */
 425         if (rt == NULL)
 426                 return NF_DROP;
 427
 428         /* No replies to physical multicast/broadcast */
 429         /* skb != PACKET_OTHERHOST handled by ip_rcv() */
 430         if (skb->pkt_type != PACKET_HOST)
 431                 return NF_DROP;
 432
 433         /* Now check at the protocol level */
 434         if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
 435                 return NF_DROP;
 436
 437         /*
 438          * Our naive response construction does not deal with IP
 439          * options, and probably should not try.
 440          */
 441         if (ip_hdrlen(skb) != sizeof(struct iphdr))
 442                 return NF_DROP;
 443
 444         /* We are not interested in fragments */
 445         if (iph->frag_off & htons(IP_OFFSET))
 446                 return NF_DROP;
 447         tarpit_tcp4(par_net(par), skb, par->state->hook, info->variant);
 448         return NF_DROP;
 449 }
 450
 451 #ifdef WITH_IPV6
 452 static unsigned int
 453 tarpit_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 454 {
 455         const struct ipv6hdr *iph = ipv6_hdr(skb);
 456         const struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
 457         const struct xt_tarpit_tginfo *info = par->targinfo;
 458         uint8_t proto;
 459         __be16 frag_off;
 460
 461         /* Do we have an input route cache entry? (Not in PREROUTING.) */
 462         if (rt == NULL) {
 463                 pr_debug("Dropping no input route cache entry\n");
 464                 return NF_DROP;
 465         }
 466
 467         /* No replies to physical multicast/broadcast */
 468         /* skb != PACKET_OTHERHOST handled by ip_rcv() */
 469         if (skb->pkt_type != PACKET_HOST) {
 470                 pr_debug("type != PACKET_HOST");
 471                 return NF_DROP;
 472         }
 473
 474         /*
 475          * Our naive response construction does not deal with IP
 476          * options, and probably should not try.
 477          */
 478         proto = iph->nexthdr;
 479         if (ipv6_skip_exthdr(skb, skb_network_header_len(skb), &proto,
 480             &frag_off) != sizeof(struct ipv6hdr))
 481                 return NF_DROP;
 482
 483         if ((!(ipv6_addr_type(&iph->saddr) & IPV6_ADDR_UNICAST)) ||
 484             (!(ipv6_addr_type(&iph->daddr) & IPV6_ADDR_UNICAST))) {
 485                 pr_debug("addr is not unicast.\n");
 486                 return NF_DROP;
 487         }
 488         tarpit_tcp6(par_net(par), skb, par->state->hook, info->variant);
 489         return NF_DROP;
 490 }
 491 #endif
 492
 493 static struct xt_target tarpit_tg_reg[] __read_mostly = {
 494         {
 495                 .name       = "TARPIT",
 496                 .revision   = 0,
 497                 .family     = NFPROTO_IPV4,
 498                 .hooks      = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
 499                 .proto      = IPPROTO_TCP,
 500                 .target     = tarpit_tg4,
 501                 .targetsize = sizeof(struct xt_tarpit_tginfo),
 502                 .me         = THIS_MODULE,
 503         },
 504 #ifdef WITH_IPV6
 505         {
 506                 .name       = "TARPIT",
 507                 .revision   = 0,
 508                 .family     = NFPROTO_IPV6,
 509                 .hooks      = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
 510                 .proto      = IPPROTO_TCP,
 511                 .target     = tarpit_tg6,
 512                 .targetsize = sizeof(struct xt_tarpit_tginfo),
 513                 .me         = THIS_MODULE,
 514         },
 515 #endif
 516 };
 517
 518 static int __init tarpit_tg_init(void)
 519 {
 520         return xt_register_targets(tarpit_tg_reg, ARRAY_SIZE(tarpit_tg_reg));
 521 }
 522
 523 static void __exit tarpit_tg_exit(void)
 524 {
 525         xt_unregister_targets(tarpit_tg_reg, ARRAY_SIZE(tarpit_tg_reg));
 526 }
 527
 528 module_init(tarpit_tg_init);
 529 module_exit(tarpit_tg_exit);
 530 MODULE_DESCRIPTION("Xtables: \"TARPIT\", capture and hold TCP connections");
 531 MODULE_AUTHOR("Jan Engelhardt ");
 532 MODULE_LICENSE("GPL");
 533 MODULE_ALIAS("ipt_TARPIT");
 534 MODULE_ALIAS("ip6t_TARPIT");