2013年5月26日 星期日

Packet Filtering HOWTO 讀後筆記II


原文:Packet Filtering HOWTO


Packet Filtering HOWTO 讀後筆記I



7. Using iptables


Extensions to iptables: New Matches
iptables具備可擴充性(extensible),這表示我們可以在kernel或是iptable上新增新的功能。目前kernel和iptables已經具備許多的標準擴充功能,您可以在kernel/net/netfilter目錄底下看到許多的xt_XXX.c。在iptables也會有相對應的extensions,在extensions/libxt_XXX.c,iptables的extensions會被build成shared library,需要使用-m將extensions載入。如果要取得extensions('-p'的說明,只要在後面加上-h或是--help即可。
# iptables -p tcp --help
iptables v1.4.12

Usage: iptables -[ACD] chain rule-specification [options]
       iptables -I chain [rulenum] rule-specification [options]
       iptables -R chain rulenum rule-specification [options]
       iptables -D chain rulenum [options]
       iptables -[LS] [chain [rulenum]] [options]
       iptables -[FZ] [chain] [options]
       iptables -[NX] chain
       iptables -E old-chain-name new-chain-name
       iptables -P chain target [options]
       iptables -h (print this help information)

Commands:
Either long or short options are allowed.
  --append  -A chain            Append to chain
  --check   -C chain            Check for the existence of a rule
  --delete  -D chain            Delete matching rule from chain
  --delete  -D chain rulenum
                                Delete rule rulenum (1 = first) from chain
  --insert  -I chain [rulenum]
                                Insert in chain as rulenum (default 1=first)
  --replace -R chain rulenum
                                Replace rule rulenum (1 = first) in chain
  --list    -L [chain [rulenum]]
                                List the rules in a chain or all chains
  --list-rules -S [chain [rulenum]]
                                Print the rules in a chain or all chains
  --flush   -F [chain]          Delete all rules in  chain or all chains
  --zero    -Z [chain [rulenum]]
                                Zero counters in chain or all chains
  --new     -N chain            Create a new user-defined chain
  --delete-chain
            -X [chain]          Delete a user-defined chain
  --policy  -P chain target
                                Change policy on chain to target
  --rename-chain
            -E old-chain new-chain
                                Change chain name, (moving any references)
Options:
    --ipv4      -4              Nothing (line is ignored by ip6tables-restore)
    --ipv6      -6              Error (line is ignored by iptables-restore)
[!] --proto     -p proto        protocol: by number or name, eg. `tcp'
[!] --source    -s address[/mask][...]
                                source specification
[!] --destination -d address[/mask][...]
                                destination specification
[!] --in-interface -i input name[+]
                                network interface name ([+] for wildcard)
 --jump -j target
                                target for rule (may load target extension)
  --goto      -g chain
                              jump to chain with no return
  --match       -m match
                                extended match (may load extension)
  --numeric     -n              numeric output of addresses and ports
[!] --out-interface -o output name[+]
                                network interface name ([+] for wildcard)
  --table       -t table        table to manipulate (default: `filter')
  --verbose     -v              verbose mode
  --line-numbers                print line numbers when listing
  --exact       -x              expand numbers (display exact values)
[!] --fragment  -f              match second or further fragments only
  --modprobe=          try to insert modules using this command
  --set-counters PKTS BYTES     set the counter during insert/append
[!] --version   -V              print package version.

tcp match options:
[!] --tcp-flags mask comp       match when TCP flags & mask == comp
                                (Flags: SYN ACK FIN RST URG PSH ALL NONE)
[!] --syn                       match when only SYN flag set
                                (equivalent to --tcp-flags SYN,RST,ACK,FIN SYN)
[!] --source-port port[:port]
 --sport ...
                                match source port(s)
[!] --destination-port port[:port]
 --dport ...
                                match destination port(s)
[!] --tcp-option number        match if TCP option set



Other Match Extensions
mac 這個module必須用'-m mac''--match mac'載入,用於比對source MAC,只能用於PREOUTING和INPUT這兩個chain。
limit 這個module必須用'-m limit''--match limit'載入,用於限制match的速率。--limit單位可以是/second、/minute、/hour或是/day,如5/s,每秒5個。--limit-burstnumber to match in a burst。用下圖來描述這兩者的涵義

limit-burst就是水桶的容量,limit就是水桶流出的流量,當packet裝滿水桶,後面的就會被丟棄,隨著時間過去,水桶會流出lmit個packet,就是可以再允許limit流進水桶。

7.4 Target Specifications
何謂target?what to do to the packets which match our tests. This is called a rule's target.(當match我們的條件之後,所要採取的動作就稱為rule的target)。target也可以是User-defined chains。

iptables是first match,packet進入INPUT這個chain後,會由第一條rule開始比對,如果比對成功並且有明確的target(ACCRPT/DROP)就會執行丟棄/同意packet並且終止比對,當target是另外一個chain時,就會jump到該chain中繼續進行比對,如果都沒有match,就會再回到原來的chain中繼續往下比對。
# iptables -A INPUT -p icmp
# iptables -A INPUT -p icmp -j LOG
# iptables -A INPUT -p icmp -j ACCEPT
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

    0     0            icmp --  any    any     anywhere             anywhere

    0     0 LOG        icmp --  any    any     anywhere             anywhere
         LOG level warning
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination


Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

# ping 127.0.0.1 -c 1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
[ 6975.682678] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.
0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 C
ODE=0 ID=4908 SEQ=0
[ 6975.697694] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.
0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=49768 PROTO=ICMP TYPE=0
CODE=0 ID=4908 SEQ=0
64 bytes from 127.0.0.1: seq=0 ttl=64 time=34.397 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 34.397/34.397/34.397 ms
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

    2   168            icmp --  any    any     anywhere             anywhere

    2   168 LOG        icmp --  any    any     anywhere             anywhere
         LOG level warning
    2   168 ACCEPT     icmp --  any    any     anywhere             anywhere


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination


Chain OUTPUT (policy ACCEPT 2 packets, 168 bytes)
 pkts bytes target     prot opt in     out     source               destination

Extensions to iptables: New Targets
還有LOG、REJECT、RETURN和QUEUE等target。詳細用法請自行參考該page。




2013年5月25日 星期六

Packet Filtering HOWTO 讀後筆記I


原文:Packet Filtering HOWTO



3 What is a packet filter?


packet filter是一套軟體,會根據packet的header決定這個packet的命運,可能是ACCEPT(bypass)或是DROP,或是其他複雜的操作(NAT/QUEUE/LOG)。

3.2 How Do I Packet Filter Under Linux?
在Linux 1.1就有packet filtering功能,在1994年由Alan Cox根據BSD的ipfw移植過來,經過Jos Vos和其他人的努力,在1999年的Linux 2.4研發出第四代tool"iptables"使用至今。
iptables可以隨時的新增或刪除在kernel中的packet filtering table的rule,每當重新開機後,這些rule就會消失,您可以使用iptables-save/iptables-restore將這些rule存到檔案,或由檔案回存到kernel中。

6. How Packets Traverse The Filters


"filter"這個table有三個chain,分別是"INPUT""OUTPUT""FORWARD"。如下圖:

當packet傳入(incoming),會先經過Routing Decision,決定封包的去向(Local In/Forwarding/Drop),當封包經過filter的這三個chain的任何一個,都會進行rule的比對並且決定封包的去留,如果是Drop,就會立刻丟棄封包,如果是ACCEPT就會往下一個rule進行比對( `if the packet header looks like this, then here's what to do with the packet')。每一個chain都有所謂的default policy,當所有的rule在這個chain都不match,就會執行這個policy(DROP/ACCEPT)。

7. Using iptables


filter table內建的三個chain INPUT、OUTPUT和FORWARD是不能被刪除的,這裡有幾個對China進行操作的選項
  1. 新增一個chain / Create a new chain (-N).
  2. 刪除空白的chain / Delete an empty chain (-X).
  3. 改變內建的chain的policy / Change the policy for a built-in chain. (-P).
  4. 列出chain的rule / List the rules in a chain (-L).
  5. 清除所有在chain中的rule / Flush the rules out of a chain (-F).
  6. 清除chain中rule的counter / Zero the packet and byte counters on all rules in a chain (-Z).

以下是對rule進行操作的選項:
  1. 新增rule到chain的後面 / Append a new rule to a chain (-A).
  2. 插入rule到chain的某個位置 / Insert a new rule at some position in a chain (-I).
  3. 取代chain中某個rule / Replace a rule at some position in a chain (-R).
  4. 移除chain中某個rule / Delete a rule at some position in a chain, or the first that matches (-D).


7.2 Operations on a Single Rule
最常用到的就是append(-A)和delete(-D) rule到chain中,當然還有insert(-I)和replace(-R)。每一條rule基本上就是設定一些條件和target,當packet滿足這些條件,就會執行該target,可能是ACCEPT也可能是DROP。比如,我們要將source ip是127.0.0.1的ICMP做DROP:
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.2 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
# iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
#

[!] -s, --source address[/mask][,...] source address,除了可以使用IP以外,也可以是hostname,不過只有在設定的當下會做一次resolved。
[!] -p, --protocol protocol 可以是tcp、udp、udplite、icmp、esp、ah、sctp或是all,也可以是 /etc/protocols裡面的名稱,或是任何數值。
-j, --jump target This specifies the target of the rule; i.e., what to do if the packet matches it. Target也可以是 user-defined chain。
每個選項前面都可以加上!表示反向的意思。

要刪除之前設定的rule可以使用
iptables -D INPUT 1

或是
iptables -D INPUT -s 127.0.0.1 -p icmp -j DROP

第一種是刪除第一條rule,第二種是刪除符合-s 127.0.0.1 -p icmp -j DROP這個condition的rule。

常用的option還有:
[!] -i, --in-interface name packet由哪個interface收到,只能套用在INPUT、FORWARD和PREROUTING這些chain,interface name以+為結尾就表示pattern比對。如-i ppp+就會比對所有ppp開頭的interface。
[!] -o, --out-interface name packet會由哪個interface送出,只能套用在FORWARD、OUTPUT和POSTROUTING這些chain,同樣可以使用+



2013年5月1日 星期三

6 sigma上課筆記 - Interactions Plot


人視視覺上的動物,所以由圖形上來了解趨勢會比一堆數據來的容易些,在6 sigma上課筆記 - 二維表格轉Minitab格式 中,我們想知道Temp和Press對yeild有哪什麼影響,正交互作用?逆交互作用?以及有沒有交互作用?
在Minitab中可以用Interactions Plot功能來判斷。基本判斷方法:如果圖形呈現平行,就是沒有交互作用。如果圖形呈現不對稱(有增強作用)或交叉(互逆作用),就是有交互作用。
Stat > ANOVA > Interactions Plot



由圖可知有交互作用。


熱門文章