IP drop list

[Michael Orlitzky]

On 03/04/2015 06:12 PM, Jochen Bern wrote:
> On 03/04/2015 09:45 PM, Dave McGuire wrote:
>> On 03/04/2015 03:37 PM, Oliver Welter wrote:
>>> Am 04.03.2015 um 21:03 schrieb Dave McGuire: 
>>>> Am 04.03.2015 um 20:12 schrieb Michael Orlitzky: 
>>>>> Please add [DNSBL] support to iptables instead of Dovecot. It's a waste of
>>>>> effort to code it into every application that listens on the network.
> 
> (FWIW, I agree that DNSBL hooks have no business being in kernel space.
> A standard *userland* DNSBL client communicating with iptables and
> similar by means of libnetfilter_queue would sound quite promising,
> however ...)
> 

This is what I had in mind. Here's a proof of concept. First, the
iptables rule:

  iptables -A tcp_packets -p tcp --dport 443 -j NFQUEUE --queue-num 1

(the details aren't important, just send something to NFQUEUE #1).

Then create the queue as root, and drop privileges. After that you can
make accept/drop decisions in userspace. This took maybe 15 minutes
using NetfilterQueue from pypi. It would be easy to replace the

  if ipp.src == badguy

test with a real RBL lookup. But then you'd need to make the RBL list
configurable, and implement a scoring system, and document it, etc.
(i.e. all the /actual/ work).

------


import os, pwd, grp
from netfilterqueue import NetfilterQueue
from scapy.all import IP


def drop_privileges(uid_name='dovecot', gid_name='dovecot'):
    """
    Drop user/group privileges from root/root to the given ones.
    """
    if os.getuid() != 0:
        # We're not root *shrug*.
        return

    # Get the uid/gid from the name
    running_uid = pwd.getpwnam(uid_name).pw_uid
    running_gid = grp.getgrnam(gid_name).gr_gid

    # Remove group privileges
    os.setgroups([])

    # Try setting the new uid/gid
    os.setgid(running_gid)
    os.setuid(running_uid)

    # Ensure a very conservative umask
    old_umask = os.umask(077)


def callback(packet):
    """
    Callback function registered through netfilter. Will be called on
    every packet passed to the netfilter queue.
    """
    badguy = "127.0.0.1"
    ipp = IP(packet.get_payload())

    if ipp.src == badguy:
        print("Dropping packet from %s..." % badguy)
        packet.drop()
    else:
        packet.accept()


nfqueue = NetfilterQueue()
nfqueue.bind(1, callback)

drop_privileges()

try:
    nfqueue.run()
except KeyboardInterrupt:
    print("Bailing...")