iptables match rule for DNS RR?

iptables match rule for DNS RR?

[Ross Vandegrift]

Hi everyone,

Is there any netfilter work, either production or in development, that
provides a way to filter traffic based on DNS RR type?

Thanks in advance for any info,

Ross


-- 
Ross Vandegrift
ross@kallisti.us

"The good Christian should beware of mathematicians, and all those who
make empty prophecies. The danger already exists that the mathematicians
have made a covenant with the devil to darken the spirit and to confine
man in the bonds of Hell."
	--St. Augustine, De Genesi ad Litteram, Book II, xviii, 37

Re: iptables match rule for DNS RR?

[Samuel Jean]

On Wed, Apr 4, 2007, Ross Vandegrift <ross@kallisti.us> said:

> Hi everyone,

Hi!

> 
> Is there any netfilter work, either production or in development, that
> provides a way to filter traffic based on DNS RR type?

Sorry -- matching packets based on RR is not possible inside the kernel.
Netfilter needs to make a decision pretty fast and cannot wait for DNS
queries
each time a packet passes by. IMO, this makes huge sense.

However, it's possible to queue packets and let userspace tools handle the
decision. That's where such match should be implemented. Still, the
latency remains the same.

> 
> Thanks in advance for any info,
> 
> Ross
>

HTH,
Samuel

Re: iptables match rule for DNS RR?

[Ross Vandegrift]

On Wed, Apr 04, 2007 at 01:49:28PM -0000, Samuel Jean wrote:
> On Wed, Apr 4, 2007, Ross Vandegrift <ross@kallisti.us> said:
> > Is there any netfilter work, either production or in development, that
> > provides a way to filter traffic based on DNS RR type?
> 
> Sorry -- matching packets based on RR is not possible inside the kernel.
> Netfilter needs to make a decision pretty fast and cannot wait for DNS
> queries
> each time a packet passes by. IMO, this makes huge sense.

Wait, I don't want to perform a DNS lookup - rather, I have DNS
servers, and I want to be able to filter out DNS requests based on the
the types of RRs in the question section.

We're experiencing a pretty major DoS attack against our DNS servers.
One thing that we have noticed is that the questions contain lots of
RRs we know we can't answer for - ISDN, AFSDB, and other
outdated/obscure types.


-- 
Ross Vandegrift
ross@kallisti.us

"The good Christian should beware of mathematicians, and all those who
make empty prophecies. The danger already exists that the mathematicians
have made a covenant with the devil to darken the spirit and to confine
man in the bonds of Hell."
	--St. Augustine, De Genesi ad Litteram, Book II, xviii, 37

Re: iptables match rule for DNS RR?

[Patrick McHardy]

Ross Vandegrift wrote:
> Is there any netfilter work, either production or in development, that
> provides a way to filter traffic based on DNS RR type?


Not that I know of, but it shouldn't be very hard to write one.

Re: iptables match rule for DNS RR?

[Jan Engelhardt]

On Apr 4 2007 09:56, Ross Vandegrift wrote:
>On Wed, Apr 04, 2007 at 01:49:28PM -0000, Samuel Jean wrote:
>> On Wed, Apr 4, 2007, Ross Vandegrift <ross@kallisti.us> said:
>> > Is there any netfilter work, either production or in development, that
>> > provides a way to filter traffic based on DNS RR type?
>> 
>> Sorry -- matching packets based on RR is not possible inside the kernel.
>> Netfilter needs to make a decision pretty fast and cannot wait for DNS
>> queries
>> each time a packet passes by. IMO, this makes huge sense.
>
>Wait, I don't want to perform a DNS lookup - rather, I have DNS
>servers, and I want to be able to filter out DNS requests based on the
>the types of RRs in the question section.

...use l7-filter, and write your pattern.


Jan
-- 

Re: iptables match rule for DNS RR?

[Ross Vandegrift]

On Wed, Apr 04, 2007 at 10:12:38PM +0200, Jan Engelhardt wrote:
> >Wait, I don't want to perform a DNS lookup - rather, I have DNS
> >servers, and I want to be able to filter out DNS requests based on the
> >the types of RRs in the question section.
> 
> ...use l7-filter, and write your pattern.

Heh, didn't know about that, but I've come up with a userspace
ipq program that's working really well.

However I'm getting an occasional netlink error for "No such file or
directory".  It happens every 50-100k requests, I'd guess and doesn't
seem to be affecting the functionality.

What does it mean for netlink to say "no such file or directory"?


-- 
Ross Vandegrift
ross@kallisti.us

"The good Christian should beware of mathematicians, and all those who
make empty prophecies. The danger already exists that the mathematicians
have made a covenant with the devil to darken the spirit and to confine
man in the bonds of Hell."
	--St. Augustine, De Genesi ad Litteram, Book II, xviii, 37

Re: iptables match rule for DNS RR?

[Patrick McHardy]

Ross Vandegrift wrote:
> On Wed, Apr 04, 2007 at 10:12:38PM +0200, Jan Engelhardt wrote:
> 
>>>Wait, I don't want to perform a DNS lookup - rather, I have DNS
>>>servers, and I want to be able to filter out DNS requests based on the
>>>the types of RRs in the question section.
>>
>>...use l7-filter, and write your pattern.
> 
> 
> Heh, didn't know about that, but I've come up with a userspace
> ipq program that's working really well.
> 
> However I'm getting an occasional netlink error for "No such file or
> directory".  It happens every 50-100k requests, I'd guess and doesn't
> seem to be affecting the functionality.
> 
> What does it mean for netlink to say "no such file or directory"?


The queue entry you're sending a verdict for does not exist.

Re: iptables match rule for DNS RR?

[Ross Vandegrift]

On Wed, Apr 04, 2007 at 10:49:01PM +0200, Patrick McHardy wrote:
> Ross Vandegrift wrote:
> > What does it mean for netlink to say "no such file or directory"?
> 
> 
> The queue entry you're sending a verdict for does not exist.

Aha, thanks for the tip, that does make perfect sense.  Turns out I
had a packet parser bug fouling things up.

Thanks again - I'm really amazed at how easy it was to extend
netfilter to do what I needed in a pinch.  I'm now processing about
10k packets per second across a cluster of 15 servers, cutting their
CPU load by 30-50%.  I'm quite thrilled!

-- 
Ross Vandegrift
ross@kallisti.us

"The good Christian should beware of mathematicians, and all those who
make empty prophecies. The danger already exists that the mathematicians
have made a covenant with the devil to darken the spirit and to confine
man in the bonds of Hell."
	--St. Augustine, De Genesi ad Litteram, Book II, xviii, 37

Re: iptables match rule for DNS RR?

[Michael Rash]

On Apr 05, 2007, Ross Vandegrift wrote:

> On Wed, Apr 04, 2007 at 10:49:01PM +0200, Patrick McHardy wrote:
> > Ross Vandegrift wrote:
> > > What does it mean for netlink to say "no such file or directory"?
> > 
> > 
> > The queue entry you're sending a verdict for does not exist.
> 
> Aha, thanks for the tip, that does make perfect sense.  Turns out I
> had a packet parser bug fouling things up.
> 
> Thanks again - I'm really amazed at how easy it was to extend
> netfilter to do what I needed in a pinch.  I'm now processing about
> 10k packets per second across a cluster of 15 servers, cutting their
> CPU load by 30-50%.  I'm quite thrilled!

You could also potentially use the string match extension to drop
offending packets from within the kernel (you mentioned odd query types,
so this is what you would match on).  For example, for ISDN queries you
could do:

iptables -I FORWARD 1 -p udp --dport 53 -d <dns_server> -m string
--hex-string "|00 00 14 00 01|" --from 46 --algo bm -j DROP

The --from value of 46 is somewhat arbitrary, but it gets past the MAC,
IP [1], and UDP headers, with 4 bytes to spare for a query that contains
at least something like \x03com.

[1] Assuming no IP options

--
Michael Rash
http://www.cipherdyne.org/
Key fingerprint = 53EA 13EA 472E 3771 894F  AC69 95D8 5D6B A742 839F