0

At the moment I am looking for some way on Linux to have packet filter whitelisting done but based on fine-grained parameters such as packet content rather than more general parameters such as protocol type or IP source.

A security critical application running on the firewalled host must not be able to see or parse the data sent until it passes a firewall filter that only allows packets with certain predefined data (hardcoded text string commands) through.

In essence its a "seccomp-like" mechanism I'm looking for except the data source is a potentially malicious/untrusted application running on another machine.

Things I've looked but failed to understand if applicable to my use case:

  • seccomp
  • libpcap
  • Linux Socket Filtering aka Berkeley Packet Filter (BPF)
  • Snort
|improve this question
  • I guess your application is receiving from the network. What about making the critical application listen on the loopback interface and have another user-level application perform the filtering? That will be easier than programming a packet filter (which depending on the grammar might be impossible to do right with its language). – Ángel Sep 26 '14 at 16:28
  • Yes its receiving from the network. The problem with me hacking together a user-space script to do the filtering is that interpreters are not designed to parse malicious code, see the recent shellshock CVE. That's why I'd prefer to leave the filtering part to specialized software that are hardened for adversarial environments. – guestbond Sep 26 '14 at 16:34
  • You still need to create a proper filter with the tools they provide you, and their filtering system may not be suitable for the application grammar (some allow you to import plugins, but if you need to change it so much…). – Ángel Sep 26 '14 at 16:37
  • Yes I understand. That's why I'd prefer higher level lanuguage based filters like lipcap for instance. The application concerned is Tor ControlPort. The commands I'm parsing are simple text strings that I want to match specific safe whitelisted commands. My threat model involves governments with advanced malware. – guestbond Sep 26 '14 at 16:39
  • though i couldn't provide specifics since i don't know a lot about tor's protocol, i would suggest this would be better filtered by a web application firewall or something similar that understands the protocol, rather than trying to parse through every single packet for specific strings. not sure on feasibility there without doing more readhing on tor, but i would consider that line of research if i were you. – theterribletrivium Sep 26 '14 at 17:01
1

http://www.lowth.com/howto/iptables-treasures.php

And what a treasure it is. IPTables itself has a string module that can do this by looking for strings defined in the ruleset and passing them on.

http://linux.blogs.com.np/2008/03/11/iptables-string-matching/

Kernels from 2.6 include support for matching strings present in IP packets, inspecting the entire packet data. Earlier kernels supported matching at the IP header level only, which was a limitation as the rules can only be formed based on header values like IP addresses, ports, packet state etc. The netfilter iptables firewall system has undergone great advancements in the latest kernels, with the modified string matching option being more interesting among them for server administrators. The rules, based on string matching functions, are very easy to implement.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.