[PATCH] netfilter unclean match extension

[PATCH] netfilter unclean match extension

[Harald Welte]

Hi Dave!

Below is a non-crucial extension of the ipt_unclean.c module (courtesy
of Maciej Soltysiak).  Inclusion of this patch has time until
2.4.21-preX, no need for this in 2.4.20.

This patch extends unclean's module to match packets with IP unused bit
set.  This bit is the first bit in the fragmentation offset field of the
IP header. 

Exerpt from RFC 791: Various Control Flags.  Bit 0: reserved, must be zero

Checking for this zero-ness of Bit 0 is what the patch adds.

The bit may be used in very discrete OS fingerprinting as described by
Ofir Arkin in "Unverified Fields - A Problem with Firewalls & Firewall
Technology Today" available to read at:
http://www.sys-security.com/archive/papers/Unverified_Fields_1.0.pdf
http://www.sys-security.com/archive/papers/Unverified_Fields_1.0.ps

Please apply, thanks.


diff -Nru linux.orig/net/ipv4/netfilter/ipt_unclean.c linux/net/ipv4/netfilter/ipt_unclean.c
--- linux.orig/net/ipv4/netfilter/ipt_unclean.c	Thu Jan  1 01:00:00 1970
+++ linux/net/ipv4/netfilter/ipt_unclean.c	Tue Jun 11 19:26:11 2002
@@ -522,6 +522,16 @@
 		return 0;
 	}
 
+	/* CHECK: Do not use what is unused.
+	 * First bit of fragmentation flags should be unused.
+	 * May be used by OS fingerprinting tools.
+	 * 04 Jun 2002, Maciej Soltysiak, solt@dns.toxicfilms.tv
+	 */
+	if (ntohs(iph->frag_off)>>15) {
+		limpk("IP unused bit set\n");
+		return 0;
+	}
+
 	/* Per-protocol checks. */
 	switch (iph->protocol) {
 	case IPPROTO_ICMP:
-- 
Live long and prosper
- Harald Welte / laforge@gnumonks.org               http://www.gnumonks.org/
============================================================================
GCS/E/IT d- s-: a-- C+++ UL++++$ P+++ L++++$ E--- W- N++ o? K- w--- O- M- 
V-- PS+ PE-- Y+ PGP++ t++ 5-- !X !R tv-- b+++ DI? !D G+ e* h+ r% y+(*)

Re: [PATCH] netfilter unclean match extension

[David S. Miller]

Queued for 2.4.21, thanks.

Re: [PATCH] netfilter unclean match extension

[David S. Miller]

   From: Harald Welte <laforge@gnumonks.org>
   Date: Tue, 22 Oct 2002 16:40:50 +0200
   
   Exerpt from RFC 791: Various Control Flags.  Bit 0: reserved, must be zero

Just to be clear, if a future RFC or ietf working draft defines
meaning for this field, will we remove this new test from the
unclean module?

Re: [PATCH] netfilter unclean match extension

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 873 bytes --]

On Wed, Oct 23, 2002 at 04:03:14AM -0700, David Miller wrote:
>    From: Harald Welte <laforge@gnumonks.org>
>    Date: Tue, 22 Oct 2002 16:40:50 +0200
>    
>    Exerpt from RFC 791: Various Control Flags.  Bit 0: reserved, must be zero
> 
> Just to be clear, if a future RFC or ietf working draft defines
> meaning for this field, will we remove this new test from the
> unclean module?

yes, we will.  But right now the RFC doesn't only say 'reserved for future
use', but says 'must be zero'.

IIRC, this is different from the ECN case.

-- 
Live long and prosper
- Harald Welte / laforge@gnumonks.org               http://www.gnumonks.org/
============================================================================
"If this were a dictatorship, it'd be a heck of a lot easier, just so long
 as I'm the dictator."  --  George W. Bush Dec 18, 2000

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]

Re: [PATCH] netfilter unclean match extension

[David S. Miller]

   From: Harald Welte <laforge@gnumonks.org>
   Date: Wed, 23 Oct 2002 13:22:48 +0200
   
   yes, we will.  But right now the RFC doesn't only say 'reserved for future
   use', but says 'must be zero'.
   
   IIRC, this is different from the ECN case.

Look at the TCP RFC, 793, on page 15 it says:

Reserved: 6 biits

  Reserved for future use.  Must be zero.

So this is precisely like the ECN case.

Re: [PATCH] netfilter unclean match extension

[Maciej Soltysiak]

>    Exerpt from RFC 791: Various Control Flags.  Bit 0: reserved, must be zero
>
> Just to be clear, if a future RFC or ietf working draft defines
> meaning for this field, will we remove this new test from the
> unclean module?
Then, we should update the match to remove the test as it may render some
routers inoperational for some data streams, vide the ECN issue.

Best Regards,
Maciej Soltysiak

Re: [PATCH] netfilter unclean match extension

[David S. Miller]

   From: Maciej Soltysiak <solt@dns.toxicfilms.tv>
   Date: Wed, 23 Oct 2002 13:26:05 +0200 (CEST)

   > Just to be clear, if a future RFC or ietf working draft defines
   > meaning for this field, will we remove this new test from the
   > unclean module?

   Then, we should update the match to remove the test as it may render some
   routers inoperational for some data streams, vide the ECN issue.

I read rfc 791 and 793 some more.

The difference here is that for the ECN bits it says
"reserved for future use", whereas for this one flag bit
it says just "reserved".

Ok, I'm convinced :-)