IPSET?

[usefulz]

Any plans to make this into an ipset module for even faster mitigation? :)

[theojulienne]

Any plans to make this into an ipset module for even faster mitigation? :)

I'm not familiar with ipset, but it seems to be a netfilter extension, so I imagine the kernel-side module would be very similar if not the same. Can you elaborate on how ipset could make this faster? 😄

[usefulz]

Have a look: http://workshop.netfilter.org/2013/wiki/images/a/ab/Jozsef_Kadlecsik_ipset-osd-public.pdf

This is a good read, also ipset is in kernel source since 2.6.39

[theojulienne]

Interesting, thanks for the link! Unfortunately since synsanity only enters a fixed number of rules (maybe 20 or so) I'm not sure the benefits of ipset (faster support for large numbers of rules) will help much here. Almost all of the work happens in kernel space in the synsanity netfilter module.

[usefulz]

The problem is that I need to add a few thousand ports to synsanity, so that may take a while for a script to do it, is there a way to bulk add ports, and a way the limit of 20 can be raised?

[theojulienne]

The problem is that I need to add a few thousand ports to synsanity, so that may take a while for a script to do it, is there a way to bulk add ports

Ah, I see your concern. If you're happy to have a single condition /proc/net/ipt_condition/synsanity-mitigation-X control file for multiple ports you should be able to use something like the following for a range of ports (in this case, all of them):

add_synsanity_rule INPUT synsanity-mitigation-everything eth0 0:65535

and a way the limit of 20 can be raised?

Sorry I wasn't clear there, there isn't a fixed limit, just that if you're only mitigating a few ports or port ranges then you'll only end up with a small number of rules.

[usefulz]

Fair enough, could I do 2 separate conditions, like 1 for ephemeral ports 1024:65534, and 1 for 0:1023 ? Any examples you could give for that in terms of iptables rules would be good :)

[theojulienne]

Absolutely!

Following on from the usage details you can just use add_synsanity_rule multiple times, so something like:

add_synsanity_rule INPUT synsanity-mitigation-privileged-ports eth0 0:1023
add_synsanity_rule INPUT synsanity-mitigation-user-ports eth0 1024:65534

[usefulz]

Alright, sweet. Now, is this just a table hook, or can this be made to use the -t {raw,filter,mangle} table as well?

http://www.iptables.info/files/tables_traverse.jpg
https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg
http://www.iptables.info/en/structure-of-iptables.html

[theojulienne]

The setup scripts for synsanity hook both the raw table as well as filter depending on where it makes sense based on what iptables allows in different tables.

[usefulz]

Awesome! I think this will meet if not exceed all requirements for my projects. Awesome work guys!