I have a solution that works to block all of these amplification attacks now. However it is not trivial to understand or implement.
NOTE:I have glossed over some of the very complicated technical details regarding NFQUEUE like how to install,config,etc.
What are the most common ways players connect to a KF2 server:
1) They open KF2 and click browse and find a server
2) They open steam and go to the game servers option
3) They recieve an invite from a friend in steam.
4) They open KF2 and go to the console and type open IPADDRESS : port
With options 1 & 2 the player will send out a query to most, if not all KF2 servers to see who is on the server, what map is being played,etc. This is normally on the default port 27015 or whatever the server has it configured to. It looks like this:
Breaking down this communication:
1) Player sends a hello packet to the server "????TSource Engine Query\000" In this case some unprintable characters represented by ?. No. 61
2) Server response with a random string "????A?E?\v" No. 62
3) Player response with "????TSource Engine Query\000????A?E?\v" which includes the random string . This effectively authenticates them as real.
4) Server then sends the name of the server, who is playing,etc.
Amplification attacks can't replicate this challenge response process as the target of the amplification attack will never respond with the challenge as above.
So the solution is just to log all of the ip addresses who successfully do the challenge response and create a firewall rule to accept connections from those ip addresses. Easy......... If you could add one line to the source code of the game to print it to the logs. Hence this request:
https://forums.tripwireinteractive....henticated-queries-to-the-query-port.2340028/
Not so easy if you have to do a network capture phrase the packets to find the right information and then log it. The way i have set this up is using iptables and NFQUEUE. In iptables you have 3 options as an action Accept, Drop or NFQUEUE. NFQUEUE allow you to write an application to receive the packets, then do whatever you want with them. In this case i used python check if the packet contained my server name "BAz", than log the ip destination (players ip) to disk and forward the packet on.
This iptables command passes the packet to 1 of three NFQUEUE's.
Code:
iptables -I INPUT -s <SERVER IP ADDRESS> -i enp5s0 -p udp -m udp --sport 27015:27056 -j NFQUEUE --queue-balance 1:3
This code logs the ip address to disk and forwards the packet onwards.
Code:
#! /usr/bin/env python3
from netfilterqueue import NetfilterQueue
from scapy.all import *
import os
def modify(packet):
pkt = IP(packet.get_payload())
#skip small packets
if len(pkt) > 100:
f.write("{}\n".format(str(pkt.dst)))
f.flush()
packet.accept() #accept the packet
nfqueue = NetfilterQueue()
#1 is the iptabels rule queue number, modify is the callback function
nfqueue.bind(1, modify)
f = open("/var/log/kf2client", "a")
try:
print("[*] waiting for data")
nfqueue.run()
except KeyboardInterrupt:
pass
This list of ip addresses can then be turned into a ipset once sorted and unquie'd. E.g
Code:
create ActiveUsers1 hash:net family inet hashsize 32768 maxelem 1000000 bucketsize 12 initval 0xee41b63f
add ActiveUsers1 192.168.0.1
add ActiveUsers1 192.168.0.2
etc
Which results in a very large ipset. 197684 enties logged over two months or so. Which is probably also the approximate active player based assuming 1 ip per player.
Code:
Name: ActivePlayers
Type: hash:net
Revision: 7
Header: family inet hashsize 131072 maxelem 1000000 bucketsize 12 initval 0xee41b63f
Size in memory: 6246576
References: 3
Number of entries: 197684
This ipset can then be used to match players connecting to the server.
Code:
iptables -A INPUT-p udp -m conntrack --ctstate NEW -m udp --dport 7779:7779 -m set --match-set ActivePlayers src -j ACCEPT
Once this has been left running for a week or so you will have a nice list of ip addresses that covers 99% of KF2 players. Any other iptables rules that accept packets can then be removed. This doesn't cover the other ways of connecting to a KF2 server but chances are the player has already queried the server just by opening the server browser. I haven't had any false positives that i know about yet.
