From: sean darcy <seandarcy2@gmail.com>
To: netfilter@vger.kernel.org
Subject: Re: rate limit SIP INVITES
Date: Sat, 26 Sep 2020 16:45:43 -0400 [thread overview]
Message-ID: <rko99o$a11$1@ciao.gmane.io> (raw)
In-Reply-To: <rko84s$9ir$1@ciao.gmane.io>
On 9/26/20 4:26 PM, sean darcy wrote:
> On 9/26/20 3:10 PM, sean darcy wrote:
>> nftables-0.9.6
>>
>> I'm running a VOIP server. There are lots of script kiddies who will
>> bang away with 10/sec SIP INVITES or REGISTERS .
>>
>> In iptables you can match on the string:
>>
>> -A SIP -i eth0 -p udp -m udp --dport 5060 -m string --string
>> "INVITE" --algo bm --from 23 --to 28 -m comment --comment "Catch SIP
>> INVITEs" -j SIPINVITE
>>
>> -A SIP -i eth0 -p udp -m udp --dport 5060 -m string --string
>> "REGISTER" --algo bm --from 23 --to 30 -m comment --comment "Catch SIP
>> REGISTERs" -j SIPREGISTER
>>
>> I'm looking at RAW to do the same:
>>
>> meta l4proto udp udp dport 5060 @th,184,224 0x494e56495445 counter
>>
>> where 184 = 23*8, and 224 = 28*8. INVITE is 0x494e56495445 in hex
>>
>> I have a prerouting chain:
>>
>> table ip filter-asterisk {
>> chain output-asterisk {
>> ..................
>> }
>>
>> chain prerouting {
>> type filter hook prerouting priority raw; policy accept;
>> }
>> }
>>
>> but no joy when I try to add the rule:
>>
>> nft add rule filter-asterisk prerouting meta l4proto udp udp dport
>> 5060 @th,184,224 0x494e56495445 counter
>> Error: Could not process rule: Value too large for defined data type
>> add rule filter-asterisk prerouting meta l4proto udp udp dport 5060
>> @th,184,224 0x494e56495445 counter
>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>
>>
>> Any help appreciated.
>>
>> sean
>>
>>
>
> Closer reading of the man page:
>
> # nft add rule filter-asterisk prerouting meta l4proto udp udp dport
> 5060 @th,184,96 0x494e56495445 counter
> #
>
> The 3rd parameter of the raw expression is bit length (16 * the six
> characters in INVITE , correct?).
>
> Now let's see if it works.
>
> sean
>
>
I'm quitting for the day. 4 bits = 1 hex number. 6 ascii characters is
12 hex numbers
, or 48 bits.
next prev parent reply other threads:[~2020-09-26 20:45 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-26 19:10 rate limit SIP INVITES sean darcy
2020-09-26 20:26 ` sean darcy
2020-09-26 20:34 ` sean darcy
2020-09-26 20:45 ` sean darcy [this message]
2020-09-27 13:54 ` Pablo Neira Ayuso
2020-09-27 14:03 ` Pablo Neira Ayuso
2020-09-27 15:42 ` sean darcy
2020-09-27 19:12 ` Florian Westphal
2020-09-27 20:59 ` Pablo Neira Ayuso
2020-09-28 18:09 ` sean darcy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='rko99o$a11$1@ciao.gmane.io' \
--to=seandarcy2@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.