Linux firewall extension technology and intrusion detection implementation

According to the firewall's internal and external data processing method, the firewall can be divided into packet filtering firewall and application layer firewall, packet filtering firewall works at the network layer, it only checks the protocol header of the packet to determine the data packet, it runs fast but cannot check the protocol content of the higher layer. the application layer firewall can check the data of the higher layer.

According to the firewall's internal and external data processing method, the firewall can be divided into packet filtering firewall and application layer firewall, packet filtering firewall works at the network layer, it only checks the protocol header of the packet to determine the data packet, it runs fast but cannot check the protocol content of the top layer. the application layer firewall can forward and filter high-level data and force authentication, however, proxy applications are required for different services and network bottlenecks are established. packet filtering and multiple application technologies are integrated, building a compound firewall is a feature of domestic firewall products and is also the mainstream technology of firewall development in the future.

In view of the data packet detection function integrated in the firewall is a good solution, it can make up for the shortcomings of the existing firewall and has the same detection function as the intrusion detection system, this article introduces the implementation mechanism and extension technology based on the Linux netfilter/iptables architecture, and proposes the extension matching option to implement the firewall's intrusion detection function, the expanded firewall can have intrusion detection functions like Snort, and can convert Snort rules into firewall rules to expand the rule set.

1 Linux firewall's extended netfilter/iptables technology

In Linux, the firewall Netfilter/Iptables system mainly includes two basic components: the general framework Net filter and Packet Selection defined in the kernel space ). the latter is composed of two parts: the data structure "IP Table" (IP Tables) defined on the Net filter framework and the application iptables implemented in the user space. for detailed firewall workflow, see [1] [2].

With the addition of the Net filter architecture, new functions can be extended through simple kernel modularization. in the existing Netfilter/Iptables, the existing firewall can be extended in two ways, one is to extend the Net filter by writing the relevant kernel module and calling nf_register_hook () to directly register on the relevant hook to obtain the new features, one is to write matching standards and objectives to implement new features in the extended IP table. the extended IP table method is to expand the matching rules of the existing table and has nothing to do with the specific table. To expand the IP table, you need to write the kernel and user code. the kernel module provides the actual packet matching rule code, and the user code provides a shared library for IPTABLE's new command line options.

2 Linux firewall intrusion detection extension matching design

Currently, intrusion detection systems generally adopt precise pattern matching algorithms. for example, Snort uses rule-based rules to match data packets to detect a variety of intrusion behaviors and detection activities, this method is simple and effective. Therefore, you can use this method to add matching options to firewall matching options to detect the content in data packets. because the extended IP table has good flexibility, therefore, we can use this method to expand the matching standards to implement the intrusion detection module.

This method requires writing kernel and user space code. the standardization of Netfilter/Iptables provides important data structures used by both parties, when implementing these two sections of code, we mainly fill in the corresponding data structure content and then register them to expand the function.

2.1 kernel module data structure

The new MATCH function can be used as an independent module. in order to enable the new module to be used by other modules, you can use iptable's iptable-provided filing-match () to register this module, the core of the new MATCH module is the JIT-match structure, which registers it as a parameter of the JIT-register-match () to the MATCH linked list for backup and adds new rule matching options.

Struct ipt_match
{Struct list_head list; generally set to {NULL, NULL}, which is used by the core.
Const char name []; MTACH function name, which must match the module name
Int (* match) (); a pointer to the MTACH function. a non-zero value is returned to indicate a match.
Int (* check entry) (); a pointer to the check rule specification. if 0 is returned, the rule is not added to iptables.
Void (* destroy) (); when an entry using the MATCH is deleted, this function is called to release the occupied resources.
Whether the struct module me is a module definition, that is, whether the module is set to THIS_MODULE or NULL}

In this data structure, it is important to use the match and check entry functions. The MATCH function will receive data packets from the underlying layer and check the data packets for matching, if the data packet is the same as the defined rule, TRUE is returned. if the data packet fails, FALSE is returned, and a parameter can be set to indicate that the data packet can be discarded immediately. The Check entry function points to a pointer to the Check rule specification. if 0 is returned, this rule cannot be accepted from the user space.

2.2 User space data structure

After related kernel module options are added to the kernel, the software must provide related command line options in order to use iptables software in the user space to provide relevant rules, to enable each extension module to use a version of iptables without having to write a specific version of the related extension software, the shared library can solve this problem. The shared library should have the-init () function, its functions are similar to those of kernel modules and are automatically called during loading. this function calls register-MATCH () or register-TARGET () based on the new match and new target (), the shared library can initialize the data structure and provide related options.

Iptables_match is an important data structure used in the shared library. it is passed as a parameter to the register-match () registration-related command line match option to enable iptables to recognize the new match.

Struct iptables_match
{Struct iptables_match * next; used to form a pointer to the MATCH list, initialized to NULL
Ipt_chainlabel name; name of the MATCH function,
Must be the same as the library function name, so that the main program can load the corresponding dynamic connection Library according to the MATCH name
Const char * version; version information is usually set to IPTABLES_version macro
Size_t size; data size of the MATCH
Size_t userspacesize; because the kernel may modify some domains,
Enter the size of the changed data area here, which is generally the same as the size
Void (* help) (void); print the outline of the help options
Void (* init) (); initialize the put-entry-match structure
Int (* parse) (); scans and receives the command line parameters of this MATCH, and correctly accepts the returned Non-0
Void (* final_check) (); check whether the mandatory option (for example, -- ids) is described. if it is incorrect, exit
Void (* print) (); when querying the rules in the current table, additional information about the current match rule is displayed.
Void (* save) (); reverse of PARSE. it is called by iptable-save to regenerate the command line parameters of match.
Const struct option * extra_opts; a list of parameters ending with NULL. other options of the command line are provided.
/* The following parameters are used internally by iptables. you do not need to enter them */
Unsigned int option_offset;
Struct ipt_entry_match * m;
Unsigned int mflags;
Unsigned int used;
}

2.3 implementation of the intrusion detection module

The function extension introduced in this article is to use the IPTABLE command to add string matching rules and packet content matching to the "IP table" of the firewall to detect packets, in the kernel, you need to add an ids detection and matching module. on the user space command line, you need to provide an "iptables-m ids? Ids "match content" option.

The kernel module mainly implements the MATCH pointer function, which uses the string pattern matching algorithm to detect the data packet content. Pattern matching refers to Text = tlt2t3... in tn, the substring Pat = P1 p2... all the appearance of pn (pattern), famous matching algorithms include BF algorithm, KMP algorithm, BM algorithm and some improved algorithms, the BMH algorithm based on the BM algorithm is proved to be a fast and efficient algorithm, so it is used in design.

The BMH algorithm was proposed by Horspool in 1980. during the matching process, the algorithm proceeds from left to right, but the comparison proceeds from right to left. when no matching is found, the algorithm shifts the mode right based on the pre-calculated skip array. the complexity of the BMH algorithm in the worst case is O (NM), which generally has better performance than the BM, it only uses one array, simplifying the initialization process. the following is the BMH algorithm used in the match function:

Char * ids_match
(Char * pattern, char * text, int pattern_len, int text_len)
{
Int k, right_end, j, I, * skip;
K = right_end = pattern _ len-1;
For (I = 0; I <1024; I ++) skip [I] = pattern_len; // initialize the skip array
For (I = 0; pattern [I]; I ++) skip [pattern [I] = k-I; // modify the skip array
While (right_end <text_len ){
For (I = 0; I <pattern _ len & text [right_end-I] = pattern [k-I]; I ++ );
If (I = pattern _ len ){
Return text + (right_end-k); // return the starting point of text matching.
}
Right_end = right_end + skip [text [right_end];
// Shift the skip [text [right_end] bit to the right in mode
}
Return NULL;
}

The detection function is mainly composed of match (const struct sk_buff * skb, const struct net_device * in, const struct net_device * out, const void * match info, int offset, const void * hdr, u_int16_t datalen, int * hotdrop) function implementation, this function reads network data packets from the buffer skb, uses match info to accept matching content from the user space, calculates the data packet size from skb tlen, obtain the size of the matching content mlen from match info. if the data packet content is null or mlen> tlen, 0 is returned and cannot be compared; otherwise, the content of the network packet matches the data in tlen and match info, and the mlen is called as the parameter ids_match to return the matching result.

When filling in the data structure of the user space, ensure that the Match name corresponding to the name and the core is the same, and to provide command line additional options, fill in the extra_opts data structure to {"ids, 1}. it indicates that ids has a parameter value. if "-ids" matches the value ", '1' is returned for parse () to process the additional information, such as checking whether there are any non (!) The matched content is parsed from the command line and filled into the data structure passed into the kernel module.

2.4 IPTABLE patch mechanism

After writing the user space and kernel space code, you can directly modify the source code and compile and install it. for standardization and convenience, NETFILTER/IPTABLES provides patches to expand the kernel and user space: the patch-o-iptables used for kernel patches and the extensions directory under the iptables source code are used for iptables program patches.

In patch-o-iptables, a "runme" script is provided to patch the core. There are five functional files: main program file, kernel configuration file patch, kernel configuration file help patch, runme script display help information, kernel make file patch. The extension of iptables itself is a little simpler, that is, add a libipt_ids.c file under the extensions directory, and then append an ids string to the PF_EXT_SLIB macro of Make file in the sub-directory.

After a patch or code is added to the kernel, you need to re-compile the kernel to add the corresponding functional modules. in the user space, you must re-compile iptables to provide new functional options.

2.5 convert Snort rules to IPTABLES rules

After the character matching module is added, you can use IPTABLES to define corresponding character matching rules.