Software Release - psad-2.2
21 April, 2012
After a long development cycle, the 2.2 release of psad is
available for download. This release adds
major new functionality for the detection of malicious traffic that is delivered over IPv6 by
parsing ip6tables logs. A significant portion of this capability is enabled by the
excellent NetAddr::IP CPAN
module that can properly handle IPv6 addresses. In addition, speed optimizations have been
made that result in psad-2.2 being about 15% faster than previous releases, several bugs have
been fixed (including one that caused compile time warnings on recent versions of perl), and
a comprehensive test suite has been added. psad-2.2 is a stepping stone to the upcoming
psad-3.0 release that will include support for both PF and ipfw firewalls running on *BSD
systems. Quite a bit of this work has already been done in the
openbsd_integration
branch.
Here is an excerpt of the psad-2.2 ChangeLog:
- Added support for detection of malicious traffic that is delivered via
IPv6. This is accomplished by parsing ip6tables log messages - these are
in a slightly different format than the iptables log messages. Here is
an example:
Mar 17 13:39:13 linux kernel: [956932.483644] DROP IN=eth0 OUT= MAC=00:13:46:3a:41:36:00:1b:b9:76:9c:e4:86:dd SRC=2001:0db8:0000:f101:0000:0000:0000:0002 DST=2001:0db8:0000:f101:0000:0000:0000:0001 LEN=80 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=50326 DPT=993 WINDOW=5760 RES=0x00 SYN URGP=0
Detection of malicious IPv6 traffic can be disabled via a new ENABLE_IPV6_DETECTION config variable. - For ICMP6 traffic, added protocol validation for ICMP6 type/code combinations.
- Added a new test suite in the test/ directory to validate psad run time operations (scan detection, signature matching, and more). To support this, a new '--install-test-dir' option was added to the install.pl script. Once this is executed, the test suite can be run via the test-psad.pl script in the test/ directory.
- Added a new MAX_SCAN_IP_PAIRS config variable to allow psad memory usage to be constrained by restricting the number of unique IP pairs that psad This is useful for when psad is deployed on systems with little memory, and is best utilized in conjunction with disabling ENABLE_PERSISTENCE so that old scans will also be deleted (and thereby making room for tracking new scans under the MAX_SCAN_IP_PAIRS threshold).
- Bug fix for 'qw(...) usage as parenthesis' warnings for perl > 5.14
- Bug fix that caused psad to emit the following:
Undefined subroutine &main::LOG_DAEMON called at ./psad line 10071.
This problem was noticed by Robert and reported on the psad mailing list. - Bug fix for ICMP packet handling where psad would incorrectly interpret
ICMP port unreachable messages as UDP packets because the UDP specifics
are included in the iptables log message. This bug was first reported by
Lukas Baxa to the Debian maintainers and was followed up by Franck
Joncourt: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596240
An example ICMP log message that exposed the bug is included below:
Sep 8 18:04:26 baxic kernel: [28241.572876] IN_DROP IN=wlan0 OUT= MAC=00:1a:9f:91:df:ae:00:21:27:e8:0a:a0:08:00 SRC=10.0.0.138 DST=192.168.1.103 LEN=96 TOS=0x00 PREC=0xC0 TTL=254 ID=63642 PROTO=ICMP TYPE=3 CODE=3 [SRC=192.168.1.103 DST=10.0.0.138 LEN=68 TOS=0x00 PREC=0x00 TTL=0 ID=22458 PROTO=UDP SPT=35080 DPT=33434 LEN=48 ]
