From: sean darcy <seandarcy2@gmail.com>
To: netfilter@vger.kernel.org
Subject: Re: rate limit SIP INVITES
Date: Sat, 26 Sep 2020 16:45:43 -0400 [thread overview]
Message-ID: <rko99o$a11$1@ciao.gmane.io> (raw)
In-Reply-To: <rko84s$9ir$1@ciao.gmane.io>
On 9/26/20 4:26 PM, sean darcy wrote:
> On 9/26/20 3:10 PM, sean darcy wrote:
>> nftables-0.9.6
>>
>> I'm running a VOIP server. There are lots of script kiddies who will
>> bang away with 10/sec SIP INVITES or REGISTERS .
>>
>> In iptables you can match on the string:
>>
>> -A SIP -i eth0 -p udp -m udp --dport 5060 -m string --string
>> "INVITE" --algo bm --from 23 --to 28 -m comment --comment "Catch SIP
>> INVITEs" -j SIPINVITE
>>
>> -A SIP -i eth0 -p udp -m udp --dport 5060 -m string --string
>> "REGISTER" --algo bm --from 23 --to 30 -m comment --comment "Catch SIP
>> REGISTERs" -j SIPREGISTER
>>
>> I'm looking at RAW to do the same:
>>
>> meta l4proto udp udp dport 5060 @th,184,224 0x494e56495445 counter
>>
>> where 184 = 23*8, and 224 = 28*8. INVITE is 0x494e56495445 in hex
>>
>> I have a prerouting chain:
>>
>> table ip filter-asterisk {
>> chain output-asterisk {
>> ..................
>> }
>>
>> chain prerouting {
>> type filter hook prerouting priority raw; policy accept;
>> }
>> }
>>
>> but no joy when I try to add the rule:
>>
>> nft add rule filter-asterisk prerouting meta l4proto udp udp dport
>> 5060 @th,184,224 0x494e56495445 counter
>> Error: Could not process rule: Value too large for defined data type
>> add rule filter-asterisk prerouting meta l4proto udp udp dport 5060
>> @th,184,224 0x494e56495445 counter
>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>>
>>
>> Any help appreciated.
>>
>> sean
>>
>>
>
> Closer reading of the man page:
>
> # nft add rule filter-asterisk prerouting meta l4proto udp udp dport
> 5060 @th,184,96 0x494e56495445 counter
> #
>
> The 3rd parameter of the raw expression is bit length (16 * the six
> characters in INVITE , correct?).
>
> Now let's see if it works.
>
> sean
>
>
I'm quitting for the day. 4 bits = 1 hex number. 6 ascii characters is
12 hex numbers
, or 48 bits.
next prev parent reply other threads:[~2020-09-26 20:45 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-26 19:10 rate limit SIP INVITES sean darcy
2020-09-26 20:26 ` sean darcy
2020-09-26 20:34 ` sean darcy
2020-09-26 20:45 ` sean darcy [this message]
2020-09-27 13:54 ` Pablo Neira Ayuso
2020-09-27 14:03 ` Pablo Neira Ayuso
2020-09-27 15:42 ` sean darcy
2020-09-27 19:12 ` Florian Westphal
2020-09-27 20:59 ` Pablo Neira Ayuso
2020-09-28 18:09 ` sean darcy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='rko99o$a11$1@ciao.gmane.io' \
--to=seandarcy2@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox