IP SCFW, SYN Cookies Firewall

IP SCFW, SYN Cookies Firewall

SYN cookies are a technique to prevent SYN flooding attack. It was originated from D. J. Bernstein and Eric Schenk, and it is now a standard part of Linux kernel. However, the implementation in Linux is now aimed to protect only the box. The IP SCFW tries to create a firewall feature in Linux that provides SYN cookies protection for the entire internal network. You can use this firewall to interdict half-open TCP connection, so the protected server will not enter half-open state (TCP_SYN_RECV). When the connection is fully established, the firewall relays the connection between the client and the server.

What is SYN flooding attack? (Quoted from CERT's alert)
When a system (called the client) attempts to establish a TCP connection to a system providing a service (the server), the client and server exchange a set sequence of messages. This connection technique applies to all TCP connections-telnet, Web, email, etc.

The client system begins by sending a SYN message to the server. The server then acknowledges the SYN message by sending SYN-ACK message to the client. The client then finishes establishing the connection by responding with an ACK message. The connection between the client and the server is then open, and the service-specific data can be exchanged between the client and the server. Here is a view of this message flow:

              Client                  Server
              ------                  ------
               SYN-------------------->

                 <--------------------SYN-ACK

               ACK-------------------->

               Client and server can now
               send service-specific data

The potential for abuse arises at the point where the server system has sent an acknowledgment (SYN-ACK) back to client but has not yet received the ACK message. This is what we mean by half-open connection. The server has built in its system memory a data structure describing all pending connections. This data structure is of finite size, and it can be made to overflow by intentionally creating too many partially open connections.

Creating half-open connections is easily accomplished with IP spoofing. The attacking system sends SYN messages to the victim server system; these appear to be legitimate but in fact reference a client system that is unable to respond to the SYN-ACK messages. This means that the final ACK message will never be sent to the victim server system.

The half-open connections data structure on the victim server system will eventually fill; then the system will be unable to accept any new incoming connections until the table is emptied out. Normally there is a timeout associated with a pending connection, so the half-open connections will eventually expire and the victim server system will recover. However, the attacking system can simply continue sending IP-spoofed packets requesting new connections faster than the victim system can expire the pending connections.

In most cases, the victim of such an attack will have difficulty in accepting any new incoming network connection. In these cases, the attack does not affect existing incoming connections or the ability to originate outgoing network connections.

However, in some cases, the system may exhaust memory, crash, or be rendered otherwise inoperative.

The location of the attacking system is obscured because the source addresses in the SYN packets are often implausible. When the packet arrives at the victim server system, there is no way to determine its true source. Since the network forwards packets based on destination address, the only way to validate the source of a packet is to use input source filtering.

What are SYN cookies?
SYN cookies are an implementation of TCP that can respond to the TCP SYN request with a cookie. Following the descriptions above, in normal TCP implementation, when the server received a SYN packet, it responds with a SYN-ACK to acknowledge, and enter the TCP_SYN_RECV state (half-open connection) to wait the last ACK. The server uses a data structure describing all pending connections, and the data structure is of finite size. Therefore, the attacker may fill up the structure.

In the SYN cookies implementation of TCP, when the server received a SYN packet, it responds a SYN-ACK packet with the ACK sequence number calculated from source address, source port, source sequence, destination address, destination port and a secret seed. Then the server releases state. If an ACK comes from the client, the server can recalculate it to determine if it is a response to the former SYN-ACK. If it is, the server can directly enter the TCP_ESTABLISHED state and open the connection. In this way, the server avoids to keep watch half-open connections.

This is just the basic idea of SYN cookies. There are still many mechanics in the implementation.

What is the SYN cookies firewall?
SYN cookies firewall is an extension of SYN cookies. SYN cookies is built in the TCP stack of a Linux, it protects the Linux box. SYN cookies firewall adds a firewall feature in Linux, you can use it as a firewall to protect your network to avoid SYN flooding attacks.

            client           firewall           server
            ------          ----------          ------
   1.        SYN----------- - - - - - - - - - ->
   2.           <------------SYN-ACK(cookie)
   3.        ACK----------- - - - - - - - - - ->
   4.           - - - - - - -SYN--------------->
   5.           <- - - - - - - - - ------------SYN-ACK
   6.           - - - - - - -ACK--------------->

   7.           -----------> relay the  ------->
                <----------- connection <-------

   1. A SYN is sent from C (client) to S (server)
   2. The firewall acts as S to respond a SYN-ACK with SYN cookie.
   3. C sends the ACK. Then the connection should be established.
   4. The firewall acts as C to send a SYN to S.
   5. S responds to the SYN and sends it to C.
   6. The firewall acts as C to send the ACK. Then the connection is established.
   7. The firewall relays data between C and S.

If the server is under attack, the step 3 will never occur. Nevertheless, both the firewall and the server do not hold corresponding data of the SYN received in step 1. SYN flooding has therefore been beat.

本文介紹了４個概念
一：介紹SYN
二：什麼是SYN洪水***
三：什麼是SYN cookie

四：什麼是SYN cookie防火牆
C=client(客戶器)
S=Server(服務器)
FW=Firewall(防火牆)

一：介紹SYN
SYN cookie是一個防止SYN洪水***技術。他由D. J. Bernstein和Eric Schenk發明。現在SYN COOKIE已經是linux內核的一部分了（我插一句，默認的stat是no),但是在linux系統的執行過程中它只保護linux系統。我們這裏只 是說創建一個linux防火牆，他可以爲整個網絡和所有的網絡操作系統提供SYN COOKIE保護你可以用這個防火牆來阻斷半開放式tcp連接，所以這個受保護的系統不會進入半開放狀態(TCP_SYN_RECV)。當連接完全建立的 時候，客戶機到服務器的連接要通過防火牆來中轉完成。二：什麼是SYN洪水***？（來自CERT的警告）
當一個系統（我們叫他客戶端）嘗試和一個提供了服務的系統（服務器）建立TCP連接，C和服務端會交換一系列報文。這種連接技術廣泛的應用在各種TCP連接中，例如telnet,Web,email,等等。
首先是C發送一個SYN報文給服務端，然後這個服務端發送一個SYN-ACK包以迴應C，接着，C就返回一個ACK包來實現一次完整的TCP連接。就這樣，C到服務端的連接就建立了，這時C和服務端就可以互相交換數據了。下面是上文的圖片說明：）
Client Server
—— ——
SYN——————–>

<——————–SYN-ACK

ACK——————–>

Client and server can now
send service-specific data

在S返回一個確認的SYN-ACK包的時候有個潛在的弊端，他可能不會接到C迴應的ACK包。這個也就是所謂的半開放連接，S需要耗費一定的數量的系統資源來等待這個未決的連接，雖然這個數量是受限的，但是惡意者可以通過創建很多的半開放式連接來發動SYN洪水***。

通過ip欺騙可以很容易的實現半開放連接。***者發送SYN包給受害者系統，這個看起來是合法的，但事實上所謂的C根本不會迴應這個SYN-ACK報文，這意味着受害者將永遠不會接到ACK報文。
而此時，半開放連接將最終耗用受害者所有的系統資源，受害者將不能再接收任何其他的請求。通常等待ACK返回包有超時限制，所以半開放連接將最終超時，而 受害者系統也會自動修復。雖然這樣，但是在受害者系統修復之前，***者可以很容易的一直髮送虛假的SYN請求包來持續***。
在大多數情況下，受害者幾乎不能接受任何其他的請求，但是這種***不會影響到已經存在的進站或者是出站連接。雖然這樣，受害者系統還是可能耗盡系統資源， 以導致其他種種問題。***系統的位置幾乎是不可確認的，因爲SYN包中的源地址多數都是虛假的。當SYN包到達受害者系統的時候，沒有辦法找到他的真實地 址，因爲在基於源地址的數據包傳輸中，源ip過濾是唯一可以驗證數據包源的方法。

三：什麼是SYN cookie？
SYN cookie就是用一個cookie來響應TCP SYN請求的TCP實現，根據上面的描述，在正常的TCP實現中，當S接收到一個SYN數據包，他返回一個SYN-ACK包來應答，然後進入TCP- SYN-RECV（半開放連接）狀態來等待最後返回的ACK包。S用一個數據空間來描述所有未決的連接，然而這個數據空間的大小是有限的，所以***者將塞 滿這個空間。在TCP SYN COOKIE的執行過程中，當S接收到一個SYN包的時候，他返回一個SYN-ACK包，這個數據包的ACK序列號是經過加密的，也就是說，它由源地址， 端口源次序，目標地址，目標端口和一個加密種子計算得出。然後S釋放所有的狀態。如果一個ACK包從C返回，S將重新計算它來判斷它是不是上個SYN- ACK的返回包。如果這樣，S就可以直接進入TCP連接狀態並打開連接。這樣，S就可以避免守侯半開放連接了。
以上只是SYN COOKIE的基本思路，它在應用過程中仍然有許多技巧。請在前幾年的kernel郵件列表查看archive of discussions的相關詳細

內容。
4，什麼是SYN COOKIE 防火牆
SYN COOKIE 防火牆是SYN cookie的一個擴展，SYN cookie是建立在TCP堆棧上的，他爲linux操作系統提供保護。SYN cookie防火牆是linux的一大特色，你可以使用一個防火牆來保護你的網絡以避免遭受SYN洪水***。
下面是SYN cookie防火牆的原理
client firewall server
—— ———- ——
1. SYN———– - - - - - - - - - ->
2. <————SYN-ACK(cookie)
3. ACK———– - - - - - - - - - ->
4. - - - - - - -SYN—————>
5. <- - - - - - - - - ————SYN-ACK
6. - - - - - - -ACK—————>

7. ———–> relay the ——->
<———– connection <——-
1:一個SYN包從C發送到S
2：防火牆在這裏扮演了S的角色來回應一個帶SYN cookie的SYN-ACK包給C
3：C發送ACK包，接着防火牆和C的連接就建立了。
4：防火牆這個時候扮演C的角色發送一個SYN給S
5：S返回一個SYN給C
6：防火牆扮演C發送一個ACK確認包給S，這個時候防火牆和S的連接也就建立了
7：防火牆轉發C和S間的數據
如果系統遭受SYN Flood，那麼第三步就不會有，而且無論在防火牆還是S都不會收到相應在第一步的SYN包，所以我們就擊退了這次SYN洪水***

五：下載

ip_scfw-0.92.tar.gzhttp://www.bronzesoft.org/projects/scfw/ip_scfw- 0.9.2.tar.gz)是最新的版本，他包括一個for linux 2.2.17內核的補丁和管理工具，下載他並按照readme文件安裝。

Designhttp://www.bronzesoft.org/projects/scfw/Design）是一個詳細的解釋了這個代碼的文檔，它也包含在這個tar-gz包內，你也可以在線閱讀它

ChangeLoghttp://www.bronzesoft.org/projects/scfw/ChangeLog）說到了這個計劃的進展。

tcpdos.tgzhttp://www.bronzesoft.org/projects/scfw/tcpdos.tgz)是一個發起SYN洪水***的工具，你可以使用它來測試你的SYN cookie防火牆