Stuff - Githubissues

plajjan commented 8 years ago

Must have

[x] Configuration is currently completely static. We need to be able to reconfigure while the program is running. Other programs are doing this. I suppose we can get some inspiration from them. Just re-read config file every Nth second or so?
[x] Support mitigation for multiple destination IPs with different rules!? At the very least I suppose we should differentiate so that if a source IP is blocked for attacking X it can still communicate with Y.
Nice to have
[x] Egress traffic back over the same physical interface it came in on but with a VLAN. This way we can halve the number of required 10G ports. (#3)
[ ] Egress traffic to actual egress PE router in the network. For this the traffic needs to be encapsulated with something like GRE or L2TPv3. We would also need a proper routing table so we know which PE to send the traffic to. ( #7 )
[ ] This app won't reply to ARP or anything so the router that sends traffic to us currently needs to have a static ARP entry to our MAC address. (#4) We can live with static entries in the meantime.
[ ] On egress we don't currently rewrite the MAC address nor do we implement any form of routing. Perhaps "default" will do, ie we really just send to a pre-configured MAC address? regardless, we need to rewrite the destination MAC in the packet to that address before sending. ( #4 )

plajjan commented 8 years ago

So I assumed there was an ARP app readily available. I was wrong. I really don't want to focus on writing one before the hackday so I suggest we stick with static ARP entry on the router and in SnabbDDoS we use static destination MAC for egress traffic.

plajjan commented 8 years ago

Multiple mitigations is fixed through 42ce74a353d83c915aef3b213330f369aa0bbe82.

plajjan commented 8 years ago

Mitigation configuration is now (after 95a07303b90451ae8e6f47a590d553ce0b819756 ) in a separate file but it's still not reloaded continuously.

plajjan commented 8 years ago

I implemented reloading of the config in a9a0b7f1a43eb3fa16f9d57f964285f8b2af0cd9 It's rather ugly with re-reading the content of the file every second (called from periodic()) and if a change is detected we actually load the new config. self.sources is reset on loading of config so current state of sources is lost. We should obviously do this in a more graceful manner.

plajjan commented 8 years ago

I'm closing this as I've created separate issues for all individual items.

plajjan / snabbswitch

Stuff #1

Must have

Nice to have