Adjusted some more plugins for ipv6

  * create_chain_tcp_header_check
  * create_chain_tcp_scan_handling
  * handleICMP (Bugfix)
  * handleTracerouteUdp

diff --git a/share/plugins/plugin.d/create_chain_tcp_header_check b/share/plugins/plugin.d/create_chain_tcp_header_check
index 3533d90..11bab0b 100755 (executable)
--- a/share/plugins/plugin.d/create_chain_tcp_header_check
+++ b/share/plugins/plugin.d/create_chain_tcp_header_check
@@ -25,4 +25,14 @@ iptables -A tcp_header_check -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state
 iptables -A tcp_header_check -p tcp ! --syn -m state --state NEW -m limit --limit 3/m --limit-burst 5 -j LOG --log-prefix "alff new-without-syn: "
 iptables -A tcp_header_check -p tcp ! --syn -m state --state NEW -j DROP
 
+##
+# If packet has SYN/ACK set and is new to ct, someone is trying nasty things
+ip6tables -A tcp_header_check -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -m limit --limit 3/m --limit-burst 5 -j LOG --log-prefix "alff syn-ack-but-new: "
+ip6tables -A tcp_header_check -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset 
+
+##
+# If the paket is new to conntrack but does not have 'syn' set, someone is trying nasty things, too
+ip6tables -A tcp_header_check -p tcp ! --syn -m state --state NEW -m limit --limit 3/m --limit-burst 5 -j LOG --log-prefix "alff new-without-syn: "
+ip6tables -A tcp_header_check -p tcp ! --syn -m state --state NEW -j DROP
+
 EOF

diff --git a/share/plugins/plugin.d/create_chain_tcp_scan_handling b/share/plugins/plugin.d/create_chain_tcp_scan_handling
index cb8f82c..503f684 100755 (executable)
--- a/share/plugins/plugin.d/create_chain_tcp_scan_handling
+++ b/share/plugins/plugin.d/create_chain_tcp_scan_handling
@@ -53,6 +53,36 @@ cat <<- EOF >&3
        iptables -A tcp_scan_handling -p tcp --tcp-flags ALL NONE \
          -m limit --limit 3/m --limit-burst 5 -j LOG --log-level ${loglevel} --log-prefix "Stealth Null scan: "
 
+       # ipv6
+       # (NMAP) FIN/URG/PSH
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL FIN,URG,PSH \
+         -m limit --limit 3/m --limit-burst 5 -j LOG --log-level ${loglevel} --log-prefix "Stealth XMAS scan: "
+       
+       # SYN/RST/ACK/FIN/URG
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \
+         -m limit --limit 3/m --limit-burst 5 -j LOG --log-level ${loglevel} --log-prefix "Stealth XMAS-PSH scan: "
+       
+       # ALL/ALL
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL ALL \
+         -m limit --limit 3/m --limit-burst 5 -j LOG --log-level ${loglevel} --log-prefix "Stealth XMAS-ALL scan: "
+       
+       # NMAP FIN Stealth
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL FIN \
+         -m limit --limit 3/m --limit-burst 5 -j LOG --log-level ${loglevel} --log-prefix "Stealth FIN scan: "
+       
+       # SYN/RST
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags SYN,RST SYN,RST \
+         -m limit --limit 3/m --limit-burst 5 -j LOG --log-level ${loglevel} --log-prefix "Stealth SYN/RST scan: "
+       
+       # SYN/FIN (probably)
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags SYN,FIN SYN,FIN \
+         -m limit --limit 3/m --limit-burst 5 -j LOG --log-level ${loglevel} --log-prefix "Stealth SYN/FIN scan(?): "
+       
+       # Null scan
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL NONE \
+         -m limit --limit 3/m --limit-burst 5 -j LOG --log-level ${loglevel} --log-prefix "Stealth Null scan: "
+
+
 EOF
 
 else
@@ -93,6 +123,36 @@ cat <<- EOF >&3
        ################
        iptables -A tcp_scan_handling -p tcp --tcp-flags ALL NONE -j DROP
 
+       # IPv6
+       # NMAP FIN/URG/PSH
+       ##################
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
+
+       # SYN/RST/ACK/FIN/URG
+       #####################
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
+
+       # ALL/ALL Scan
+       ##############
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL ALL -j DROP
+
+       # NMAP FIN Stealth
+       ##################
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL FIN -j DROP
+
+       # SYN/RST
+       #########
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+
+       # SYN/FIN -- Scan(probably)
+       ###########################
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
+
+       # NMAP Null Scan
+       ################
+       ip6tables -A tcp_scan_handling -p tcp --tcp-flags ALL NONE -j DROP
+
+
 EOF
 
 else

diff --git a/share/plugins/plugin.d/handleICMP b/share/plugins/plugin.d/handleICMP
index 83a10e9..1f41c3c 100755 (executable)
--- a/share/plugins/plugin.d/handleICMP
+++ b/share/plugins/plugin.d/handleICMP
@@ -19,6 +19,7 @@ my $allow_icmp = $config->getOption( "allow_icmp" );
 
 $alff->create_chain( $chain );
 $alff->write_line("iptables -A FORWARD -p icmp -j $chain");
+$alff->write_line("ip6tables -A FORWARD -p icmpv6 -j $chain");
 
 # ICMP (partly) allowed
 if ( $allow_icmp ne "none" ) {

diff --git a/share/plugins/plugin.d/handleTracerouteUdp b/share/plugins/plugin.d/handleTracerouteUdp
index 4a72640..0b487da 100755 (executable)
--- a/share/plugins/plugin.d/handleTracerouteUdp
+++ b/share/plugins/plugin.d/handleTracerouteUdp
@@ -18,4 +18,5 @@ my $allow_traceroute_udp = $config->getOption( "allow_traceroute_udp" );
 if ( $allow_traceroute_udp eq "yes" ) {
        print " * Allowing udp traceroute...\n";
        $alff->write_line("iptables -A FORWARD -p udp --dport 33434:33523 -j ACCEPT");
+       $alff->write_line("ip6tables -A FORWARD -p udp --dport 33434:33523 -j ACCEPT");
 }