⬢ DragonFlyBSD Kernel Audit
DF-3456 / setup_pf.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
#!/bin/sh
# DF-3456 setup v6 (run as root in the guest).
#
# v6 lessons:
#  - pfctl drops EMPTY inline anchors; inline anchors need a placeholder rule
#  - an inline  anchor "inner1"  inside anchor "spam" is walked by the kernel
#    as the doubled path  spam/spam/inner1  -> load walked decoys there
#  - `pass all no state` so EVERY packet walks rules (no state short-circuit)
#
# main:
#   pass all no state
#   anchor "spam" {
#       <300 udp decoys>
#       anchor "inner1" { pass udp port 9998 }   -> walked as spam/spam/inner1
#       block drop udp 127.0.0.1->127.0.0.1 port 5555     (lo bypass sensor)
#       block drop udp from 10.0.2.2 port 53               (dns response sensor)
#       anchor "inner2" { pass udp port 9999 }   -> walked as spam/spam/inner2
#       <300 tail decoys>
#   }
#   anchor "ham" { pass udp port 9997 }          -> walked as ham
#   block drop udp 127.0.0.1->127.0.0.1 port 5556  (control)
NPRE=${NPRE:-300}
NTAIL=${NTAIL:-300}
CONF=/tmp/df3456-pf.conf

kldload pf 2>/dev/null

{
    echo '# DF-3456 ruleset v6'
    echo 'pass all no state'
    echo 'anchor "spam" {'
    i=0
    while [ $i -lt $NPRE ]; do
        echo "  pass inet proto udp from 127.0.0.1 to 127.0.0.1 port $((6000 + i % 1000))"
        i=$((i + 1))
    done
    echo '  anchor "inner1" {'
    echo '    pass inet proto udp from 127.0.0.1 to 127.0.0.1 port 9998'
    echo '  }'
    echo '  block drop inet proto udp from 127.0.0.1 to 127.0.0.1 port 5555'
    echo '  block drop inet proto udp from 10.0.2.2 to any port 53'
    echo '  anchor "inner2" {'
    echo '    pass inet proto udp from 127.0.0.1 to 127.0.0.1 port 9999'
    echo '  }'
    i=0
    while [ $i -lt $NTAIL ]; do
        echo "  pass inet proto udp from 127.0.0.1 to 127.0.0.1 port $((8100 + i % 500))"
        i=$((i + 1))
    done
    echo '}'
    echo 'anchor "ham" {'
    echo '  pass inet proto udp from 127.0.0.1 to 127.0.0.1 port 9997'
    echo '}'
    echo 'block drop inet proto udp from 127.0.0.1 to 127.0.0.1 port 5556'
} > $CONF

{
    i=0
    while [ $i -lt 1000 ]; do
        echo "pass inet proto udp from 127.0.0.1 to 127.0.0.1 port $((7000 + i % 1000))"
        i=$((i + 1))
    done
} > /tmp/df3456-inner1.conf
{
    i=0
    while [ $i -lt 10 ]; do
        echo "pass inet proto udp from 127.0.0.1 to 127.0.0.1 port $((8000 + i))"
        i=$((i + 1))
    done
} > /tmp/df3456-inner2.conf
{
    i=0
    while [ $i -lt 500 ]; do
        echo "pass inet proto udp from 127.0.0.1 to 127.0.0.1 port $((8600 + i % 500))"
        i=$((i + 1))
    done
} > /tmp/df3456-ham.conf

pfctl -d 2>/dev/null
pfctl -F all 2>/dev/null
pfctl -f $CONF || exit 1
pfctl -a spam/spam/inner1 -f /tmp/df3456-inner1.conf || exit 1
pfctl -a spam/spam/inner2 -f /tmp/df3456-inner2.conf || exit 1
pfctl -a ham -f /tmp/df3456-ham.conf || exit 1
echo "-- main ruleset:";    pfctl -sr
echo "-- inner1 decoys:";   pfctl -a spam/spam/inner1 -sr | wc -l
echo "-- inner2 decoys:";   pfctl -a spam/spam/inner2 -sr | wc -l
echo "-- ham decoys:";      pfctl -a ham -sr | wc -l
pfctl -e