Re: iptables match rule for DNS RR?

[Michael Rash <mbr@cipherdyne.org>]

On Apr 05, 2007, Ross Vandegrift wrote:

> On Wed, Apr 04, 2007 at 10:49:01PM +0200, Patrick McHardy wrote:
> > Ross Vandegrift wrote:
> > > What does it mean for netlink to say "no such file or directory"?
> > 
> > 
> > The queue entry you're sending a verdict for does not exist.
> 
> Aha, thanks for the tip, that does make perfect sense.  Turns out I
> had a packet parser bug fouling things up.
> 
> Thanks again - I'm really amazed at how easy it was to extend
> netfilter to do what I needed in a pinch.  I'm now processing about
> 10k packets per second across a cluster of 15 servers, cutting their
> CPU load by 30-50%.  I'm quite thrilled!

You could also potentially use the string match extension to drop
offending packets from within the kernel (you mentioned odd query types,
so this is what you would match on).  For example, for ISDN queries you
could do:

iptables -I FORWARD 1 -p udp --dport 53 -d <dns_server> -m string
--hex-string "|00 00 14 00 01|" --from 46 --algo bm -j DROP

The --from value of 46 is somewhat arbitrary, but it gets past the MAC,
IP [1], and UDP headers, with 4 bytes to spare for a query that contains
at least something like \x03com.

[1] Assuming no IP options

--
Michael Rash
http://www.cipherdyne.org/
Key fingerprint = 53EA 13EA 472E 3771 894F  AC69 95D8 5D6B A742 839F