Linux Server DDOs Fix 1.7.1

1:
2:
3:
4:
5:
6:

set sv_queryIgnoreDebug 1 // Schreib Aktionen in das Logfile (kann dann sehr groß werden!)
set sv_queryIgnoreMegs 1 //Platz  in MB für Memory-File für bekannte Adressen. (1=65000 Adressen 12=1 Mio ;) )
set sv_queryIgnoreTime 2 // Zeit in Miilisekunden innerhalb der Server keine neue Anfragen von der selben IP-Adresse beantwortet.
set sv_queryBounceIgnoreTime 1200 // Wenn die Reverse "bist du da" Anfrage des Servers an den Absender abgewiesen wird - wie lange soll keine neue Anfrage von dieser IP-Adresse zugelassen werden in Millisekunden 

• Url zum Thread in der Mailingliste http://icculus.org/pipermail/cod/2011-Au...read.html#15397
  
• Patch Download bei Icculus http://treefort.icculus.org/cod/cod4-lnx...it-test.tar.bz2
  
• Patch History und Download auf OL https://www.opferlamm-clan.de/patch-history-fuer-codmw.html
  

Zitat:

THIS IS A BETA BUILD OF COD4. RUN AT YOUR OWN RISK.

Call Of Duty 4(tm)
Linux Multiplayer Server Code
Version 1.7.1
Readme
Last update: 2011-08-01


2. Upgrading to 1.7.1

Just stop the game server, replace cod4_lnxded-bin, etc on your server with
the files included in this package, and restart the game server. New files
may be added, such as main/iw_12.iwd; make sure they land in the correct
subdirectory. Please verify that your mods are compatible with the new
version; that is beyond the scope of this document.

[...]
7. Linux-specific version!

Version 1.7.1 is Linux-specific hotfix, and is otherwise equivalent to
version 1.7 on other platforms. The server will report itself as 1.7.
This patch adds support for query limits.

About query limits:

There is a class of DDoS attack that can utilize COD4 servers to flood a
third party, by spoofing UDP packets so that the game server sends its
reply for information to an unsuspecting party, over and over, as fast as
it can. Unlike most packets sent by the server, this reply packet does not
require a player with a legitimate connection before sending.

This patch sets up some reasonable defaults to limit the rate at which the
server will send these reply packets to a given IP address. It does not
throttle legitimate connections in the process.

The gist is this: If someone sends a query packet, we note their IP
address and ignore any further queries for X seconds. If they send a
port-unreachable packet (person being spoofed isn't playing the game),
we ignore their IP address for Y seconds. This will let normal people
play, it prevents people that don't have a legitimate player connection
from flooding the server with queries, and it'll stop DDoS attacks
against third parties.

If millions of computers try to wail on a single server, this patch
should handle it gracefully (we don't allocate memory when adding IP
addresses to the ignore list, we use a hashtable so we don't have to
check millions of IP addresses for every query, and we clean out old
addresses a little each frame).

People that are connected to the server don't have their packets
ignored; this only limits server responses to packets that don't need a
valid player connection (like the infostring, etc). LAN addresses are
never limited.

Admins can tune it (and turn it off completely) with cvars.

Note that a single IP address using different ports all get lumped into
the same ignore list entry. This is to make life difficult for attackers
and keep things efficient on the server. If 16 players are all behind
the same NAT, they might notice it takes longer for the server to
respond to each of them individually at the start. They should run a LAN
server anyhow, but gameplay will still perform normally here.

Server admins have 4 cvars to control this:

sv_queryIgnoreDebug: set to 1 to log information about attacks. This will
write out a lot of logging. Defaults to 0.

sv_queryIgnoreMegs: Number of megabytes we should use to store the
ignore list. Set to 0 to turn off the ignore list (basically disables
this patch). 1 megabyte handles about 65000 IP addresses, each megabyte
after the first adds about 87000 more. 1 is probably fine unless you're
under serious attack, but maybe a server wants to spare 12 megs to block
a million IP addresses simultaneously. Defaults to 1.

sv_queryIgnoreTime: Number of milliseconds to ignore an IP address's
info requests after responding to one of them. Set to 0 to not ignore at
all. Defaults to 2000 (2 seconds).

sv_queryBounceIgnoreTime: Number of milliseconds to ignore an IP
address's info requests after a server packet bounced with an ICMP Port
Unreachable notice. Set to 0 to not ignore at all. Defaults to 12000 (2
_minutes_).


// end of README.linux ...

Zitat:

> Is there any clue about a possible fix for windows version ? Not that
> I'm concerned (I'm running linux servers), but know about some teams
> that are running this wth windows, so they are also in need of a patch.

I think my changes will apply to Windows, but I don't have plans to
build a Windows server. Infinity Ward will have my source code changes
if they want to, though.

--ryan.

Zitat:

But, we're looking at things, like security things of like how can we address hacking on Call of Duty 4? And, we've been already doing updates on MW2 to address hacking, and basically once we get MW2 on lockdown, then the guys who have the ability to focus on even further legacy things, (such as) how can we lockdown things on CoD 4. Actually, we just did on PC a Linux patch."

Zitat:

Original von wgs./w@Lly

Oder könnte es sein dass sie nun eben auf die CoD2-Server umgeswitcht sind, die vermutlich die gleiche Lücke haben?

Zitat:

Original von wgs./w@Lly
Bin außerdem hierauf gestoßen:
http://wiki.modsrepository.com/index.php...rewall_solution

Eventuell kann man diese Angriffe auch über Firewall ausschließen.

1:
2:
3:
4:

IPTABLES -A INPUT -p UDP -m length --length 42 -m recent --set --name getstatus_cod
IPTABLES -A INPUT -p UDP -m string --algo bm --string "getstatus" -m recent --update --seconds 1 --hitcount 20 --name getstatus_cod -j DROP

Zitat:

Original von wgs./w@Lly
Gibt es denn durch diese Regel irgendwelche spürbaren Einschränkungen im normalen Betrieb? Nicht dass beim Teamspeak dann nur jedes dritte Wort durchkommt oder so

Zitat:

Original von KellerkindAber wird sicher auch jemand bei modsrepository genau so erfolgreich getestet haben ehe sie es dort gepostet haben.

Zitat:

In Deutschland ist die Beteiligung an DoS-Attacken als "Computersabotage" nach § 303b Abs. 1 StGB mit bis zu drei Jahren Freiheitsstrafe oder mit Geldstrafe bedroht, wenn die Dateneingabe oder -übermittlung in der Absicht erfolgt, einem anderen Nachteil zuzufügen, und dadurch eine Datenverarbeitung, die für einen anderen von wesentlicher Bedeutung ist, erheblich gestört wird.

Gemäß § 303b Abs. 3 StGB ist auch der Versuch strafbar. Daneben ist ferner auch die Vorbereitung einer Straftat nach § 303b Abs. 1 StGB selbst strafbar, § 303b Abs. 5 StGB i. V. m. § 202c StGB. Hierunter fällt insbesondere die Herstellung und Verbreitung von Computerprogrammen für DoS-Attacken.

Außerdem kann der Geschädigte Schadenersatz fordern.

Zitat:

> If you leave the server up'n running for a certain period of time (no
> restart for 3 weeks let's say) it seems that when the
> sv_queryIgnoreMegs limit is reached (our servers don't have a lot of
> players) the server starts to reply to the query with the spoofed IP's.
> A restart of the server solves the problem.

Zitat:

I think this is my bug...the server timer is rolling over and I'm not
handling that correctly. I'll fix this.

--ryan.