On 03/04/2015 06:12 PM, Jochen Bern wrote:
> On 03/04/2015 09:45 PM, Dave McGuire wrote:
>> On 03/04/2015 03:37 PM, Oliver Welter wrote:
>>> Am 04.03.2015 um 21:03 schrieb Dave McGuire:
>>>> Am 04.03.2015 um 20:12 schrieb Michael Orlitzky:
>>>>> Please add [DNSBL] support to iptables instead of Dovecot. It's a waste of
>>>>> effort to code it into every application that listens on the network.
>
> (FWIW, I agree that DNSBL hooks have no business being in kernel space.
> A standard *userland* DNSBL client communicating with iptables and
> similar by means of libnetfilter_queue would sound quite promising,
> however ...)
>
This is what I had in mind. Here's a proof of concept. First, the
iptables rule:
iptables -A tcp_packets -p tcp --dport 443 -j NFQUEUE --queue-num 1
(the details aren't important, just send something to NFQUEUE #1).
Then create the queue as root, and drop privileges. After that you can
make accept/drop decisions in userspace. This took maybe 15 minutes
using NetfilterQueue from pypi. It would be easy to replace the
if ipp.src == badguy
test with a real RBL lookup. But then you'd need to make the RBL list
configurable, and implement a scoring system, and document it, etc.
(i.e. all the /actual/ work).
------
import os, pwd, grp
from netfilterqueue import NetfilterQueue
from scapy.all import IP
def drop_privileges(uid_name='dovecot', gid_name='dovecot'):
"""
Drop user/group privileges from root/root to the given ones.
"""
if os.getuid() != 0:
# We're not root *shrug*.
return
# Get the uid/gid from the name
running_uid = pwd.getpwnam(uid_name).pw_uid
running_gid = grp.getgrnam(gid_name).gr_gid
# Remove group privileges
os.setgroups([])
# Try setting the new uid/gid
os.setgid(running_gid)
os.setuid(running_uid)
# Ensure a very conservative umask
old_umask = os.umask(077)
def callback(packet):
"""
Callback function registered through netfilter. Will be called on
every packet passed to the netfilter queue.
"""
badguy = "127.0.0.1"
ipp = IP(packet.get_payload())
if ipp.src == badguy:
print("Dropping packet from %s..." % badguy)
packet.drop()
else:
packet.accept()
nfqueue = NetfilterQueue()
nfqueue.bind(1, callback)
drop_privileges()
try:
nfqueue.run()
except KeyboardInterrupt:
print("Bailing...")
