Reject work v1.3 #563
Closed
Reject work v1.3 #563
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This variable can be used to indicate to suricata that the host running is running as a router or is in sniffing only mode. This will used at least to determine which interfaces are used to send reject message.
Reindent file and use some switch instead of if else if.
This patch update reject code to send the packet on the interface it comes from when 'host-mode' is set to 'sniffer-only'. When 'host-mode' is set to 'router', the reject packet is sent via the routing interface. This should fix OISF#957.
We have follow TCP RFC (http://tools.ietf.org/html/rfc793#section-3.4). There is two cases depending on wether the original packet contains a ACK. If packet has no ACK, the RST seq number is 0 and the ACK is built the standard way. If packet has a ACK, the seq of the RST packet is equal to the ACK of incoming packet and the ACK is build using packet sequence number and size of the data. Regarding standard Ack number, it is computed using seq number of captured packet added to packet length. Finally 1 is added so we respect the RFC: If the ACK control bit is set this field contains the value of the next sequence number the sender of the segment is expecting to receive. Once a connection is established this is always sent. With this patch we have some correct results. With the following rule: reject ssh any any -> 192.168.56.3 any (msg:"no SSH way"; sid:3; rev:1;) ssh connection to 192.168.56.3 is correctly resetted on client side. But this is not perfect. If we have the following rule: reject tcp any any -> 192.168.56.3 22 (msg:"no way"; sid:2; rev:1;) then the connection is not resetted on a standard ethernet network. But if we introduce 20ms delay on packets, then it is correctly resetted. This is explained when looking at the network trace. The reset is sent as answer to the SYN packet and it is emitted after the SYN ACK from server because the exchange is really fast. So this is discarded by the client OS which has already seen a ACK for the same sequence number. This should fix OISF#895.
With this patch reject is now available in IPv6.
| } else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { | ||
| return RejectSendLibnet11L3IPv6TCP(tv, p, data, REJECT_DIR_DST); | ||
| } else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { | ||
| if (RejectSendLibnet11L3IPv6TCP(tv, p, data, REJECT_DIR_SRC) == 0 && |
There was a problem hiding this comment.
Here REJECT_DIR_DST will not be considered if REJECT_DIR_SRC fails. I think we should try to fail more gracefully.
There was a problem hiding this comment.
Fixing it incremental. This is a duplicate of IPv4 code.
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This patchset is a rework of the reject keyword. It fixes a few problem and adds IPv6 support.
This should fix #895 #956 and #957
Buildbot build: https://buildbot.suricata-ids.org/builders/regit/builds/34