ruleset: make synflood lighter using ct state #31
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Make synflood inteject as found in default setup quicker by using ct state attribute and avoiding packet data examination. Bytecode before: ``` // block A implicit [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] // block B V1 [ payload load 1b @ transport header + 13 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x00000017 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000002 ] // verdict [ immediate reg 0 jump -> syn_flood ] ``` After: ``` // block B V2 [ ct load state => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x00000008 ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000000 ] // block A explicit [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] // verdict [ immediate reg 0 jump -> syn_flood ] ```
Author
|
Reordering conditions presumes ct state is cache-hot at the point, can be vice-versa. Either way falls under measurable timer resolution compared to payload loading. EDIT: hi @jow- |
Somewhat similar to PR22 to discard packets as soon as it is known they need to be discarded. Proto first not viable in this place
quite dumb to add extra checks before mainstream state plays This reverts commit aeb6cac.
brada4
changed the title
Author
|
Got hint in forums another (starting empty) chain of similar power is useful in forward chain. |
brada4
changed the title
Author
|
default net.netfilter.nf_conntrack_tcp_loose=1 permits opening connection state with 2x synack and bypass intended protection. Update follows the setting. |
Author
|
small rework due - also take care of forwarded traffic. |
Author
|
.. not |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Make synflood inteject as found in default setup quicker by using ct state attribute and avoiding packet data examination.
Bytecode before:
After:
Signed-Off-By: Andris PE neandris@gmail.com