2013年6月8日 星期六

RFC 5952 - A Recommendation for IPv6 Address Text Representation 之筆記


1. Introduction

RFC 5952主要在定義IPv6 address的表示法的標準化,主要原因是因為RFC 4291 - IP Version 6 Addressing Architecture定義了IPv6 address,且提供了一些彈性表示法,卻也因為彈性導致相同的address卻有不同的表示法(換言之,不同的表示法卻是指向同一address),這會導致一些問題產生。

以下的IPv6 address都是相同的:
2001:db8:0:0:1:0:0:1
2001:0db8:0:0:1:0:0:1 
2001:db8::1:0:0:1
2001:db8::0:1:0:0:1 
2001:0db8::1:0:0:1
2001:db8:0:0:1::1 
2001:db8:0000:0:1::1
2001:DB8:0:0:1::1 



2. Text Representation Flexibility of RFC 4291


2.1. Leading Zeros in a 16-Bit Field
'It is not necessary to write the leading zeros in an individual field.'
以0為開頭的字沒必要寫,因為這樣,所以0開頭的字母可寫可不寫,如:
2001:db8:aaaa:bbbb:cccc:dddd:eeee:0001
2001:db8:aaaa:bbbb:cccc:dddd:eeee:001
2001:db8:aaaa:bbbb:cccc:dddd:eeee:01
2001:db8:aaaa:bbbb:cccc:dddd:eeee:1


2.2. Zero Compression
'A special syntax is available to compress the zeros. The use of "::" indicates one or more groups of 16 bits of zeros.'
'The "::" can only appear once in an address.'
可以將1個或多個的"0000"用::這個特殊寫法表示,不過只能出現一次如:
2001:db8:0:0:0::1
2001:db8:0:0::1
2001:db8:0::1
2001:db8::1


2.3. Uppercase or Lowercase
RFC 4291並沒有特別指明說要用大寫或小寫表示之。


3. Problems Encountered with the Flexible Model


簡單來說,就是比對會有問題,比如對eth0指定IPv6網址2001:db8:0:0:1::1,之後用ifconfig eth0| grep 來找卻找不到,因為ifconfig顯示的是2001:db8::1:0:0:1這個IPv6 address。大小寫的差異在UNIX系統更是常見,比如2001:db8:0:0:1:0:0:1和2001:DB8:0:0:1:0:0:1在比對沒有特別指明case insensitive參數就會視為不同。


4. A Recommendation for IPv6 Text Representation


4.1. Handling Leading Zeros in a 16-Bit Field
Leading zeros MUST be suppressed.0開頭的字母都必須被省略,如2001:0db8::0001這是不行的,必須寫成2001:db8::1。

4.2. "::" Usage
The use of the symbol "::" MUST be used to its maximum capability. The symbol "::" MUST NOT be used to shorten just one 16-bit 0 field.
表示式必須盡可能的簡化,而且只有一個"0000"時不能簡化。所以2001:db8:0:0:0:0:2:1是不正確的,應該被寫成2001:db8::2:1。而2001:db8::1:1:1:1:1卻是不正確的,應該被寫成2001:db8:0:1:1:1:1:1。
When there is an alternative choice in the placement of a "::", the longest run of consecutive 16-bit 0 fields MUST be shortened. When the length of the consecutive 16-bit 0 fields are equal, the first sequence of zero bits MUST be shortened.
簡而言之,就是如果有兩個可以簡化::的地方,挑表示式最小,如果都是最小,則挑第一個位置。如2001:0:0:1:0:0:0:1必須被簡化為2001::1:0:0:0:1。

4.3. Lowercase
用小寫表示之。


5. Text Representation of Special Addresses


IPv4-Mapped IPv6 addresses [RFC5214]的寫法要符合前面的規則,且後面為IPv4寫法,如0:0:0:0:0:ffff:192.0.2.1應該被寫成::ffff:192.0.2.1。


6. Notes on Combining IPv6 Addresses with Port Numbers


以下是一般結合port的寫法:
  • [2001:db8::1]:80
  • 2001:db8::1:80
  • 2001:db8::1.80
  • 2001:db8::1 port 80
  • 2001:db8::1p80
  • 2001:db8::1#80

建議使用第一種寫法[2001:db8::1]:80





2013年5月26日 星期日

Packet Filtering HOWTO 讀後筆記II


原文:Packet Filtering HOWTO


Packet Filtering HOWTO 讀後筆記I



7. Using iptables


Extensions to iptables: New Matches
iptables具備可擴充性(extensible),這表示我們可以在kernel或是iptable上新增新的功能。目前kernel和iptables已經具備許多的標準擴充功能,您可以在kernel/net/netfilter目錄底下看到許多的xt_XXX.c。在iptables也會有相對應的extensions,在extensions/libxt_XXX.c,iptables的extensions會被build成shared library,需要使用-m將extensions載入。如果要取得extensions('-p'的說明,只要在後面加上-h或是--help即可。
# iptables -p tcp --help
iptables v1.4.12

Usage: iptables -[ACD] chain rule-specification [options]
       iptables -I chain [rulenum] rule-specification [options]
       iptables -R chain rulenum rule-specification [options]
       iptables -D chain rulenum [options]
       iptables -[LS] [chain [rulenum]] [options]
       iptables -[FZ] [chain] [options]
       iptables -[NX] chain
       iptables -E old-chain-name new-chain-name
       iptables -P chain target [options]
       iptables -h (print this help information)

Commands:
Either long or short options are allowed.
  --append  -A chain            Append to chain
  --check   -C chain            Check for the existence of a rule
  --delete  -D chain            Delete matching rule from chain
  --delete  -D chain rulenum
                                Delete rule rulenum (1 = first) from chain
  --insert  -I chain [rulenum]
                                Insert in chain as rulenum (default 1=first)
  --replace -R chain rulenum
                                Replace rule rulenum (1 = first) in chain
  --list    -L [chain [rulenum]]
                                List the rules in a chain or all chains
  --list-rules -S [chain [rulenum]]
                                Print the rules in a chain or all chains
  --flush   -F [chain]          Delete all rules in  chain or all chains
  --zero    -Z [chain [rulenum]]
                                Zero counters in chain or all chains
  --new     -N chain            Create a new user-defined chain
  --delete-chain
            -X [chain]          Delete a user-defined chain
  --policy  -P chain target
                                Change policy on chain to target
  --rename-chain
            -E old-chain new-chain
                                Change chain name, (moving any references)
Options:
    --ipv4      -4              Nothing (line is ignored by ip6tables-restore)
    --ipv6      -6              Error (line is ignored by iptables-restore)
[!] --proto     -p proto        protocol: by number or name, eg. `tcp'
[!] --source    -s address[/mask][...]
                                source specification
[!] --destination -d address[/mask][...]
                                destination specification
[!] --in-interface -i input name[+]
                                network interface name ([+] for wildcard)
 --jump -j target
                                target for rule (may load target extension)
  --goto      -g chain
                              jump to chain with no return
  --match       -m match
                                extended match (may load extension)
  --numeric     -n              numeric output of addresses and ports
[!] --out-interface -o output name[+]
                                network interface name ([+] for wildcard)
  --table       -t table        table to manipulate (default: `filter')
  --verbose     -v              verbose mode
  --line-numbers                print line numbers when listing
  --exact       -x              expand numbers (display exact values)
[!] --fragment  -f              match second or further fragments only
  --modprobe=          try to insert modules using this command
  --set-counters PKTS BYTES     set the counter during insert/append
[!] --version   -V              print package version.

tcp match options:
[!] --tcp-flags mask comp       match when TCP flags & mask == comp
                                (Flags: SYN ACK FIN RST URG PSH ALL NONE)
[!] --syn                       match when only SYN flag set
                                (equivalent to --tcp-flags SYN,RST,ACK,FIN SYN)
[!] --source-port port[:port]
 --sport ...
                                match source port(s)
[!] --destination-port port[:port]
 --dport ...
                                match destination port(s)
[!] --tcp-option number        match if TCP option set



Other Match Extensions
mac 這個module必須用'-m mac''--match mac'載入,用於比對source MAC,只能用於PREOUTING和INPUT這兩個chain。
limit 這個module必須用'-m limit''--match limit'載入,用於限制match的速率。--limit單位可以是/second、/minute、/hour或是/day,如5/s,每秒5個。--limit-burstnumber to match in a burst。用下圖來描述這兩者的涵義

limit-burst就是水桶的容量,limit就是水桶流出的流量,當packet裝滿水桶,後面的就會被丟棄,隨著時間過去,水桶會流出lmit個packet,就是可以再允許limit流進水桶。

7.4 Target Specifications
何謂target?what to do to the packets which match our tests. This is called a rule's target.(當match我們的條件之後,所要採取的動作就稱為rule的target)。target也可以是User-defined chains。

iptables是first match,packet進入INPUT這個chain後,會由第一條rule開始比對,如果比對成功並且有明確的target(ACCRPT/DROP)就會執行丟棄/同意packet並且終止比對,當target是另外一個chain時,就會jump到該chain中繼續進行比對,如果都沒有match,就會再回到原來的chain中繼續往下比對。
# iptables -A INPUT -p icmp
# iptables -A INPUT -p icmp -j LOG
# iptables -A INPUT -p icmp -j ACCEPT
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

    0     0            icmp --  any    any     anywhere             anywhere

    0     0 LOG        icmp --  any    any     anywhere             anywhere
         LOG level warning
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination


Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

# ping 127.0.0.1 -c 1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
[ 6975.682678] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.
0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 C
ODE=0 ID=4908 SEQ=0
[ 6975.697694] IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.
0.0.1 DST=127.0.0.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=49768 PROTO=ICMP TYPE=0
CODE=0 ID=4908 SEQ=0
64 bytes from 127.0.0.1: seq=0 ttl=64 time=34.397 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 34.397/34.397/34.397 ms
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

    2   168            icmp --  any    any     anywhere             anywhere

    2   168 LOG        icmp --  any    any     anywhere             anywhere
         LOG level warning
    2   168 ACCEPT     icmp --  any    any     anywhere             anywhere


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination


Chain OUTPUT (policy ACCEPT 2 packets, 168 bytes)
 pkts bytes target     prot opt in     out     source               destination

Extensions to iptables: New Targets
還有LOG、REJECT、RETURN和QUEUE等target。詳細用法請自行參考該page。




2013年5月25日 星期六

Packet Filtering HOWTO 讀後筆記I


原文:Packet Filtering HOWTO



3 What is a packet filter?


packet filter是一套軟體,會根據packet的header決定這個packet的命運,可能是ACCEPT(bypass)或是DROP,或是其他複雜的操作(NAT/QUEUE/LOG)。

3.2 How Do I Packet Filter Under Linux?
在Linux 1.1就有packet filtering功能,在1994年由Alan Cox根據BSD的ipfw移植過來,經過Jos Vos和其他人的努力,在1999年的Linux 2.4研發出第四代tool"iptables"使用至今。
iptables可以隨時的新增或刪除在kernel中的packet filtering table的rule,每當重新開機後,這些rule就會消失,您可以使用iptables-save/iptables-restore將這些rule存到檔案,或由檔案回存到kernel中。

6. How Packets Traverse The Filters


"filter"這個table有三個chain,分別是"INPUT""OUTPUT""FORWARD"。如下圖:

當packet傳入(incoming),會先經過Routing Decision,決定封包的去向(Local In/Forwarding/Drop),當封包經過filter的這三個chain的任何一個,都會進行rule的比對並且決定封包的去留,如果是Drop,就會立刻丟棄封包,如果是ACCEPT就會往下一個rule進行比對( `if the packet header looks like this, then here's what to do with the packet')。每一個chain都有所謂的default policy,當所有的rule在這個chain都不match,就會執行這個policy(DROP/ACCEPT)。

7. Using iptables


filter table內建的三個chain INPUT、OUTPUT和FORWARD是不能被刪除的,這裡有幾個對China進行操作的選項
  1. 新增一個chain / Create a new chain (-N).
  2. 刪除空白的chain / Delete an empty chain (-X).
  3. 改變內建的chain的policy / Change the policy for a built-in chain. (-P).
  4. 列出chain的rule / List the rules in a chain (-L).
  5. 清除所有在chain中的rule / Flush the rules out of a chain (-F).
  6. 清除chain中rule的counter / Zero the packet and byte counters on all rules in a chain (-Z).

以下是對rule進行操作的選項:
  1. 新增rule到chain的後面 / Append a new rule to a chain (-A).
  2. 插入rule到chain的某個位置 / Insert a new rule at some position in a chain (-I).
  3. 取代chain中某個rule / Replace a rule at some position in a chain (-R).
  4. 移除chain中某個rule / Delete a rule at some position in a chain, or the first that matches (-D).


7.2 Operations on a Single Rule
最常用到的就是append(-A)和delete(-D) rule到chain中,當然還有insert(-I)和replace(-R)。每一條rule基本上就是設定一些條件和target,當packet滿足這些條件,就會執行該target,可能是ACCEPT也可能是DROP。比如,我們要將source ip是127.0.0.1的ICMP做DROP:
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.2 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
# iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
#

[!] -s, --source address[/mask][,...] source address,除了可以使用IP以外,也可以是hostname,不過只有在設定的當下會做一次resolved。
[!] -p, --protocol protocol 可以是tcp、udp、udplite、icmp、esp、ah、sctp或是all,也可以是 /etc/protocols裡面的名稱,或是任何數值。
-j, --jump target This specifies the target of the rule; i.e., what to do if the packet matches it. Target也可以是 user-defined chain。
每個選項前面都可以加上!表示反向的意思。

要刪除之前設定的rule可以使用
iptables -D INPUT 1

或是
iptables -D INPUT -s 127.0.0.1 -p icmp -j DROP

第一種是刪除第一條rule,第二種是刪除符合-s 127.0.0.1 -p icmp -j DROP這個condition的rule。

常用的option還有:
[!] -i, --in-interface name packet由哪個interface收到,只能套用在INPUT、FORWARD和PREROUTING這些chain,interface name以+為結尾就表示pattern比對。如-i ppp+就會比對所有ppp開頭的interface。
[!] -o, --out-interface name packet會由哪個interface送出,只能套用在FORWARD、OUTPUT和POSTROUTING這些chain,同樣可以使用+



熱門文章