Re: NEW vs INVALID

[Cedric Blancher <blancher@cartel-securite.fr>]

Le lun 30/09/2002 à 12:18, Jens Lechtenbörger a écrit :
> using stateful packet matching I wonder how an INVALID tcp packet is
> defined.  In particular, I set up a rule to log inbound NEW ssh
> connections to port 22:
> iptables -A INPUT  -m state --state NEW -p TCP --dport 22 -j LOG
> --log-level 5 --log-prefix "IPTABLES: Legal NEW TCP: "
> What confuses me, is that this rule not only logs initial SYN
> packets but also (initial) packets with SYN and FIN set. 
> I thought that such packets should be INVALID...
> Is this a bug or a feature?

Definitly a feature ;)

States a completly different concept than TCP connection, for it must
also apply to UDP, or other layer 4 protocols, which can be
connectionless.

A NEW packet is a packet for which Netfilter cannot find an existing
state in conntrack table. This packet, if TCP, can be SYN, as it should,
but also ACK, or any flag combination you want. This packet, if allowed,
create a state that will match following packets.

An INVALID packet is a packet for which Netfilter cannot guess its
state. Most of the time, it is ICMP errors that cannot be associated
(i.e. RELATED) to an existing connection. You can also have ressources
lack or bugs.

So, a packet why strange flags combination, such as SYN+FIN, is wrong
from TCP point of vue, but is a valid packet from state tracking point
of vue. This behaviour allows you to define exactly want you want to
match. As an example, you can consider match Xmas or Null scans :

	iptables -A INPUT -m state --state NEW -p tcp --tcp-flags ALL ALL -j LOG
	iptables -A INPUT -m state --state NEW -p tcp --tcp-flags ALL NONE -j LOG

To be strict, your iptables command should be :

	iptables -A INPUT  -m state --state NEW -p TCP --dport 22 --syn -j LOG --log-level 5 --log-prefix "IPTABLES: Legal NEW TCP: "

My 2 cents of euro.

-- 
Cédric Blancher
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE