Remake of Analyser - #4
Open
tartaruslovesnoodles wants to merge 1 commit into
Open
Conversation
Fixed multiple notable bugs and vulnerabilities. Firstly, the entire iptables program was essentially being managed in the original. This prevents the use of many iptables features like ports, hex strings, tcp flags, protocols, chains, etc. This approach sets the service to use one chain. A vulnerability here was that iptables -F can cause servers with a default drop policy to drop all input and require a reboot to fix, which in some systems can be a difficult process that requires manual intervention to get it back up (ie egress routing). This is solved by just flushing the new chain we established earlier.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hello,
I noticed your "Analyser" script had some issues in scalability and accessibility for other infrastructures. The two main points I noticed was that you were essentially making a script that requires you not use iptables at all as a user. But there wasn't a 'rollover' for many iptables features, so people can't customize tcp flags, chains, protocols, ports, packet size, hex strings, etc. The primary blocker from someone using their own iptables while using this, is the repeated calling of iptables -F. This also can cause a vulnerability/issue that'll cause INPUT DROP to be the 0 priority rule and cause a reboot. This can effect some systems substantially, ie if it hit a bank Friday night and their auto startup failed.
I fixed both of these issues by reworking it to act and flush 1 chain. In the process I sort of rewrote all your PHP. This also allows for multiple concurrent operations, for example this entire script could just be for ip ratelimits, but you have another one for ports, specific protocols, etc that could all be launched by a delegator script.
Also, you should use caution if you're operating with this in active WAN production. The script as you wrote it (which, I left this part of the logic unchanged) is a little "ballistic", it doesn't account for attackers abusing the function of the script (dropping IPs sending excessive requests). Say for example, this rule set was applied to a VPN and a user was using some game server like Fortnite. Somehow, the attacker has gotten the VPN IP and he spoofs the Fornite game server IP to the VPN IP in a high pps flood. The VPN would then drop the Fortnite game server, so the attacker's goal, "Deny service to the Fortnite Game" has succeeded.
I might make another PR where I try to address this with a more robust filtering criteria, but for now, you can make a large amount of progress in preventing this with just one rule: iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT but you'll need to add it into the chain of course, or sort out the logic of how it will effect user firewalls if not in the chain. This is the first step toward a stateful system. Without this rule your firewall system is entirely stateless, which makes preventing an attack attempting to exploit your own filtering difficult.