Re: [new filter] simple packet authentication

["Andrew Hall" <temp02@bluereef.com.au>]

This is a neat idea although I'd probably be a bit wary to use the IP ID
field when considering it's use with fragments. Perhaps a better solution
would be to use part of the options field which apparently DoD originally
planned to use for this type of IP partitioning. Also it would be good if it
was payload agnostic (could be used for UDP as well as TCP).

Kind regards,

Andrew.

----- Original Message -----
From: "Alexandre Becoulet" <alexandre.becoulet@epita.fr>
To: <netfilter-devel@lists.netfilter.org>
Sent: Friday, January 23, 2004 8:04 AM
Subject: [new filter] simple packet authentication


>
> Hi,
>
> I have written a new extension to the netfilter project and i would
> like to contribute.
>
> My extension provides both, a new target to mangle packets and a new
> match rule.
>
> The idea is to have a non obvious relationship between the IP id field
> and the TCP header informations. This relationship may then be used to
> authenticate packets sender.
>
> The mangle part of the module is used to recalculate a new value for
> the id field of IP packet header. This new value is based on a hash
> value computed from the TCP sequence numbers and an optional
> passphrase. Of course we have to take care not to mangle already
> fragmented packets to keep all IP fragments with the same id.
>
> The match part of the module is able to check the IP id field against
> the locally recomputed hash value, so we may reject packets without
> correct id field value.
>
> This simple authentication system may be a good mean to avoid TCP ports
> scanning and to prevent non authorized people from connecting to ports
that
> still have to remain open for admin access.
>
> This method should be safer than matching host IP address to allow
> connection, it will allow connections from any host IP having the good
> passphrase and should prevent connections from spoofed/stolen IP
> addresses. It aims to be more simple than heavy packets authentication
> methods and leave TCP/IP packet format untouched.
>
> My implementation use a trivial hash function to remain simple and
> fast. The hash function could be replaced with a stronger digest
> algorithm like those provided in the kernel crypto API.
>
> Here is an example to show how to do simple authentication for
> incoming connections on tcp port 22:
>
>  # Server side
>  iptables -A INPUT -p tcp --syn -m hashseq --key testkey -j ACCEPT
>  iptables -A INPUT -p tcp --syn --dport 22 -j REJECT
>
>  # Client side
>  iptables -t mangle -A OUTPUT -p tcp --syn --dport 22 -j HASHSEQ \
>           --key testkey
>
> I hope my work will be of some interest. :)
>
> I just followed instructions given in the patch-o-matic README file for
the
> netfilter part. Where should i send/post my full netfilter and iptables
> extentions patchs ?
>
> Regards,
>
> --
> Alexandre Becoulet
>
>