Weblog

All | China | Cricket | General | IPFilter | OpenSolaris | Solaris IPFilter | USA vs.... | Zones
20071008 Monday October 08, 2007

UPnP daemon for Solaris/IPFilter

Over the last week or so, I've been working on porting a UPnP daemon called miniupnpd to IPFilter. Included in this effort was getting it to work on Solaris. You can download a copy of the source code now from http://coombs.anu.edu.au/~avalon/miniupnpd-20071007.avalon.tar.gz. This .tar.gz file contains a Makefile that is set for building with gcc on Solaris amd64. You will need to have the GNU make available to build it.

Getting it to work with IPFilter

The daemon will add ipnat rules (rdr's) and ipf rules to make sure your traffic gets in and through the system but you must have a head rule similar to this in your ipf.conf so that miniupnpd can add rules to let traffic in: 

block in all head miniupnpd

You will also need two ipf rules to allow the multicast traffic in and the replies back out again: 

pass in proto udp from any to 239.255.255.250 port = 1900
pass out proto udp from any port = 1900 to any

Patches are in progress to make keep state work with multicast UDP.

Enjoy!

( Oct 08 2007, 03:52:03 AM PDT ) Permalink Comments [1]

20070924 Monday September 24, 2007

IPFilter 4.1.26

It's been a while since I blogged about IPFilter. I've been attending to problems over the past few months in a fairly responsive manner. The one consistent message I get out of this is I need to do more testing. Sigh. Just developing code is much more fun :) Testing is for users ;) Of course if there are fewer features then there is also less to test and go wrong. A lot to be said for simplicity!

http://coombs.anu.edu.au/~avalon/ip_fil4.1.26.tar.gz

Changelog

4.1.26 - Released 24 September 2007

4.1.25 - Released 20 September 2007

4.1.24 - Released 8 July 2007

4.1.23 - Released 31 May 2007

( Sep 24 2007, 02:03:25 AM PDT ) Permalink Comments [2]

20070923 Sunday September 23, 2007

DNS Proxy

Today I imported a DNS proxy, that I've been hacking around on for a while, into CVS on sourceforge. As a proxy it currently does no caching of DNS queries and answers, it merely redirects them to another DNS server. What benefits does it bring then?

The primary reason for the proxy is access control of DNS queries. The proxy's main purpose is allow me to block DNS requests for, say, microsoft.com. Or perhaps more appropriately, it allows me to block DNS requests for doubleclick.net, etc - ie. advertising web sites and other sources of web page spam.

Because it has been written to work with IPFilter, it can correctly work with packets that are sent to the proxy through the use of rdr rules - i.e. it can function as a transparent proxy when in the path of DNS.

The source code is part of the IPFilter project on sourceforge.net and can be seen at http://ipfilter.cvs.sourceforge.net/ipfilter/dns-proxy/.

Limitations? It currently only works with DNS over UDP and requires IPFilter to compile. Well, there are probably lots of other limitations too, at present, as the feature set is just starting to be fleshed out.

Related to this, I'm also working on putting a simpler proxy into IPFilter 5.0 itself that allows for filtering DNS packets based on the names in the queries.

The proxy can be downloaded from sourceforge at:

http://downloads.sourceforge.net/ipfilter/dns-proxy-1.1.1.tar.gz

( Sep 23 2007, 03:49:17 PM PDT ) Permalink Comments [0]

20070610 Sunday June 10, 2007

DNS proxy for IPFilter

There seem to be a few DNS proxies out there but all seemed aimed at doing proxy+cache without being seemingly easy to control what is accepted or denied. Plus none of them work with rdr rules in ipnat. And I got tired of bind being so big and hard to make work and I didn't want to dabble with the other main alternative (there would be more work trying to get it architected right to do the transparent stuff, I'm sure.)

So this was my weekend project. Oh, it does no caching (yet.) There are man pages in the .tgz.

http://coombs.anu.edu.au/~avalon/dns-proxy.tgz

Configuration goes something like this: 

port fred 192.168.1.1 5053 transparent;
forwarders { 2.2.2.1, 2.2.2.3; };
acl all port fred { block *.xxx;};
acl all port fred { allow .cnn.com; reject cnn.com; };

To be used with rules like: 

rdr fxp0 0/0 port 53 -> 192.168.1.1 port 5053 udp

Also, seperate to this, there will be a dns proxy in IPfilter 5 that allows similar things to be done. That can be used on the outbound side of a firewall hosting named with map rules :)

Darren

( Jun 10 2007, 11:34:45 PM PDT ) Permalink Comments [2]

IPFilter 4.1.23

In the never ending quest for perfection and chasing platform changes, this latest update fixes some bugs that are new and some that are old.

I've also added this extra line to "ipfstat -s" output: 

        82% hash efficiency

The routing header problem is perhaps the most serious from a security perspective - if you weren't (or aren't) blocking these packets explicitly, e.g 

block in quick with v6hdrs routing

then the presence of the routing header would cause ipf to not find the next (TCP/UDP) header in the correct place. A regression test (ipv6.5) has been added to check for dealing with IPv6 routing header packets.

Darren


4.1.23 - Released 31 May 2007

4.1.22 - Released 13 May 2007

  • fix endless loop when flushing state/NAT by idle time

    • 4.1.21 - Released 12 May 2007

    4.1.20 - Released 30 April 2007

    4.1.19 - Released 22 February 2007

    4.1.18 - Released 18 February 2007

    4.1.17 - Released 20 January 2007

    4.1.16 - Released 20 December 2006

    4.1.15 - Released 03 November 2006

    ( Jun 10 2007, 11:29:55 PM PDT ) Permalink Comments [2]

    20070118 Thursday January 18, 2007

    IPFilter 5.0.0 - feedback requested

    So i've been implementing some new features in ipfilter, whether or not they make it a 5.0, I'm not sure...maybe a few people can let me know what they think about that..

    So what are these new features?

    There are 3 new commands for ipnat.conf:

    To help people use these, I've rewritten the ipnat.conf man page.

    divert

    A divert rule looks like this: 

    divert in on le0 proto udp from any to any port = 53 -> src 127.0.0.1,54 dst 127.0.0.1,5300;

    note the ";" on the end of the line. To the left of the "->" is the original packet to be matched, on the right, the IP/UDP header to create and put in front of the packet. Reply packets from that socket will have the IP+UDP headers removed when they get back to IPFilter. I'm hoping this will provide cross-platform "divert" functionality but it needs more widespread testing than what I've been able to achieve.

    encap

    encap is pretty much the same as divert, minus the port numbers to the right of "->".

    rewrite

    Rewrites have a subset of the combined functionality of rdr/map rules. As an example of how the man page has been rewritten, I've included the contents of it for this new command below.

    ipmon

    You can now use ipmon.conf to as the place to specify how log records are sent to syslog (facility & priority) rather than needing to do it in filter rules.

    ipf

    As part of the "keep state" options, you can now specify a rule group to which ICMP replies can be filtered by - "... keep state(icmp-head icmprules)"

    It is also now possible to position stateful filtering checks, inbound and outbound nat lookups. If this is done, the traditional checks are no longer performed. This is done as follows: 

    call now fr_checkstate in on le0 from any to any
call now fr_ipfnatin in on ppp0 all
call now fr_ipfnatout out on bge0 from bge0/32 to any

    Oh, being 5.0.0, it is a development version, there's nothing release quality about it (well, you might argue that for others too .. >:->), this is just to get some feedback from people on features and enable some people to try/test a few things out beyond my limited scope. Perhaps most importantly, most of my work to date has been limited to using NetBSD.

    It can be downloaded from ip_fil5.0.0.tar.gz. MD5 (/home/darrenr/ip_fil5.0.0.tar.gz) = 7798797c1929cb55c182d3088f40b0b5 

    REWRITING SOURCE AND DESTINATION
       Whilst the above two commands provide a lot of flexibility in changing
       addressing  fields  in packets, often it can be of benefit to translate
       both source and destination at the same time or to  change  the source
       address  on  input  or the destination address on output.  Doing all of
       these things can be accomplished using rewrite NAT rules.

       A rewrite rule requires the same level of packet  matching  as before,
       protocol  and  source/destination  information  but  in addition allows
       either in or out to be specified like this:

       rewrite in on ppp0 proto tcp from any to any port = 80 ->
            src 0/0 dst 127.0.0.1,3128;
       rewrite out on ppp0 from any to any ->
            src 0/32 dst 10.1.1.0/24;

       On the RHS we can specify both new source and  destination information
       to  place  into the packet being sent out.  As with other rules used in
       ipnat.conf, there are shortcuts syntaxes available to use the original
       address  information  (0/0) and the address associated with the network
       interface (0/32.)  For TCP and UDP, both address and  port information
       can  be  changed.   At  present it is only possible to specify either a
       range of port numbers to be used (X-Y) or a single port number (=X) as
       follows:

       rewrite in on le0 proto tcp from any to any port = 80 ->
            src 0/0,2000-20000 dst 127.0.0.1,port = 3128;

       There  are four fields that are stepped through in enumerating  the num-
       ber space available for creating a new destination:

       source address

       source port

       destination address

       destination port

       If one of these happens to be a static then it will be skipped 
       and  the  next one incremented.  As an example:

       rewrite out on le0 proto tcp from any to any port = 80 ->
            src 1.0.0.0/8,5000-5999 dst 2.0.0.0/24,6000-6999;

       The translated packets would be:
       1st src=1.0.0.1,5000 dst=2.0.0.1,6000

       2nd src=1.0.0.2,5000 dst=2.0.0.1,6000

       3rd src=1.0.0.2,5001 dst=2.0.0.1,6000

       4th src=1.0.0.2,5001 dst=2.0.0.2,6000

       5th src=1.0.0.2,5001 dst=2.0.0.2,6001

       6th src=1.0.0.3,5001 dst=2.0.0.2,6001

       and so on.

       As  with  map  rules, it is possible to specify a range of addresses by
       including the word range before the addresses:

       rewrite from any to any port = 80 ->
            src 1.1.2.3 - 1.1.2.6 dst 2.2.3.4 - 2.2.3.6;
    ( Jan 18 2007, 03:51:26 AM PST ) Permalink Comments [0]

    20061107 Tuesday November 07, 2006

    IPFilter 4.1.15 released

    The IPFilter steam train rolls on, with another version cut out primarily to deal with compilation issues on different platforms. As I'm writing this blog entry a few days after I uploaded it, I can already say that I'll need to stamp out a new release soon to deal with more of the same - issues with SuSE 10.1 are one problem, at least...so 4.1.16 is around the corner somewhere, so is a 5.0 not far away, now that I've successfully brainstormed over the weekend just gone.

    There is one new significant change and that is the application of the state table automatic flushing algorithm to the NAT table. In the state table management, if it attempts to add more entries to the table than has been declared the maximum, it sets a flag for the flushing of the table to try a bit harder to free up some entries by cleaning out what could be considered dead wood.

    4.1.15 - Released 03 November 2006

    ( Nov 07 2006, 07:01:15 AM PST ) Permalink Comments [1]

    20061002 Monday October 02, 2006

    IPFilter 4.1.14

    After what has possibly been too long, I've finally gotten around to rolling together version 4.1.14 of IPFilter.

    What took it so long?

    I got stuck into verifying all of the test results for NAT'd ICMP packets and their checksums, where unknowingly there was a bug in one of my test scripts I found by developing another path to verify checksums. Anyway, this is now done and I've a lot more confidence in the ability of IPFilter to correctly modify ICMP checksums now.

    There are two other significant changes with this version.

    The first is that output from "ipfstat -io" and similar is now all retrieved by using ioctls to iterate through in-memory lists. This should remedy that problem on Linux as well as other systems that use IPFilter and choose not to have a /dev/mem or /dev/kmem.

    The second is short pool names can now be used in filter rules like this:

    ippool.conf: 
    table role = ipf type = tree name = letters
        { 1.1.1.1/32; !2.2.0.0/16; 2.2.2.0/24; };
    ipf.conf: 
    pass in from pool/letters to any

    Anyway, I think that's all for now. I'll be updating sourceforge later in the day/week.

    http://coombs.anu.edu.au/~avalon/ip_fil4.1.14.tar.gz
    http://coombs.anu.edu.au/~avalon/patch-4.1.14..gz
    Cheers, Darren

    4.1.14 - Released 04 October 2006

    4.1.13 - Released 4 April 2006

    ( Oct 02 2006, 10:05:26 PM PDT ) Permalink Comments [5]

    Calendar

    « November 2009
    SunMonTueWedThuFriSat
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    		     
           
    Today

    RSS Feeds

    XML
    All
    /China
    /Cricket
    /General
    /IPFilter
    /OpenSolaris
    /Solaris IPFilter
    /USA vs....
    /Zones

    Search

    Links

    Navigation

    Referers

    Today's Page Hits: 42