Echo Stream Filter (echo_filter)
The Echo Stream Filter plugin is a reference and demonstration plugin showcasing RouteWarden's capability for deep real-time stream inspection. It scans bidirectional raw TCP byte streams for banned exploit keywords, SQL injection signatures, or malicious payloads, dropping or tarpitting connections before bad data reaches the destination.
Capabilities & Threat Defense
| Threat / Attack Vector | Defense Mechanism | Action Taken |
|---|---|---|
| Malicious Exploit Signatures | Inspects raw byte chunks against banned_keywords | Connection immediately severed |
| SQL Injection Probing on Raw Streams | Detects prohibited text keywords (DROP TABLE) | Stream terminated |
| Stream Floods | Enforces rate limits per minute and burst caps | Connection throttled at the proxy layer |
Installation
Install the plugin either via the command line or declaratively in your configuration file:
# Install using short nametcp-warden plugins install echo_filter# Or install via Git repository URLtcp-warden plugins install https://github.com/routewarden/plugins/echo_filterConfiguration Reference
Add an Echo Filter service to tcp-warden.yaml:
services: filter_proxy: listen: ":7001" upstream: "127.0.0.1:7000" protocol: "echo" # Or "echo_filter", "text_filter" rate_limit: connections_per_minute: 60 burst: 10 plugin_config: banned_keywords: - "EXPLOIT" - "DROP TABLE" - "MALWARE" - "RCE_TEST"Configuration Options
| Field | Type | Default | Description |
|---|---|---|---|
listen | string | ":7001" | Local proxy listen address and port. |
upstream | string | "127.0.0.1:7000" | Target backend service address and port. |
protocol | string | "echo" | Set to "echo", "echo_filter", or "text_filter". |
plugin_config.banned_keywords | []string | [...] | List of sensitive or exploit words that trigger instant termination. |
Testing & Verification
Verify filtering and keyword detection using netcat:
# 1. Start a mock upstream echo listener on target portnc -l 7000