Restrictive FTP egress using conntrack helper

Restrictive FTP egress using conntrack helper

[Michael Weiser]

Hi,

in the script that sets up my iptables firewall I found a comment I must
have written some time between 2005 and 2012:

# allowing RELATED outgoing connections makes passive FTP work without
# the need to allow all high ports out

So the following kind of very restrictive egress policing should have
worked at some point in time (2.6.x or 3.x kernels):

# Generated by iptables-save v1.6.0 on Sat Feb 11 16:45:51 2017
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [4:240]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
COMMIT
# Completed on Sat Feb 11 16:45:51 2017

Of course the conntrack helper is loaded as well:

# lsmod | grep _ftp
nf_conntrack_ftp       20480  0

My expectation is for the FTP conntack helper to recognise the 227
response in the control connection of a passive FTP session and consider
the ensuing data connection initiated by the FTP client as RELATED.
Looking at the helper's kernel code doesn't really burst that bubble
either. But I can't seem to get it to work with recent 4.x kernels
(tested with Debian kernels 4.8 and 4.9 as well as a static,
self-compiled 4.8/4.9 with Gentoo).

Am I completely off base here or just missing something trivial?

BTW: I just tried the same with nftables to no avail:

flush ruleset

table inet firewall {
        chain incoming {
                type filter hook input priority 0;
                ct state established,related accept
                log reject
        }

        chain outgoing {
                type filter hook output priority 0;
                ct state established,related accept
                tcp dport {domain, ftp} accept
                udp dport domain accept
                log reject
        }
}

I still get:

ftp> ls
227 Entering Passive Mode (134,76,12,6,119,247).
ftp: connect: Connection refused
ftp>

and

[ 4594.097676] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60
TOS=0x00 PREC=0x00 TTL=64 ID=35848 DF PROTO=TCP SPT=58314 DPT=30711
WINDOW=29200 RES=0x00 SYN URGP=0 
[ 4595.116297] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60
TOS=0x00 PREC=0x00 TTL=64 ID=35849 DF PROTO=TCP SPT=58314 DPT=30711
WINDOW=29200 RES=0x00 SYN URGP=0 
-- 
thanks, Micha

Re: Restrictive FTP egress using conntrack helper

[Robert White]

On 02/11/17 17:14, Michael Weiser wrote:
> I still get:
>
> ftp> ls
> 227 Entering Passive Mode (134,76,12,6,119,247).
> ftp: connect: Connection refused
> ftp>

I think I read somewhere that the as of Kernel 4.7 the connection 
tracker no longer _automatically_ loads the helper module. So if you've 
built the connection tracking stuff as modules you'll need to manually 
modprobe the helpers you want to use.

If you're using the kernels and building as modules I'd double-check 
lsmod before you bang your head against anything solid. 8-)

Re: Restrictive FTP egress using conntrack helper

[Pascal Hambourg]

Le 11/02/2017 à 23:13, Robert White a écrit :
>
> I think I read somewhere that the as of Kernel 4.7 the connection
> tracker no longer _automatically_ loads the helper module.

AFAIK, the connection tracking never loaded any protocol helper module 
automatically.

What has changed in recent kernels is that by default the helper is no 
more automatically associated to the "master" connection. You must do so 
explicitly with the 'CT' target, or change the default setting with some 
sysctl or module parameter I forgot about.

I fail to retrieve the information page I had read about this change, 
but this one contains useful information :
<https://home.regit.org/netfilter-en/secure-use-of-helpers/>

Re: Restrictive FTP egress using conntrack helper

[Michael Weiser]

Hi Robert,

On Sat, Feb 11, 2017 at 10:13:08PM +0000, Robert White wrote:

> I think I read somewhere that the as of Kernel 4.7 the connection tracker no
> longer _automatically_ loads the helper module. So if you've built the
> connection tracking stuff as modules you'll need to manually modprobe the
> helpers you want to use.

On the actual production machine the kernel is fully statically linked
with no modules anywhere. On my Debian test box I have the module loaded
and see the connection being tracked but no expectation for the data
connection being created:

ftp> ls
227 Entering Passive Mode (134,76,12,6,119,52).
[hang]

root@debian:~# conntrack -L
tcp      6 431965 ESTABLISHED src=192.168.137.190 dst=134.76.12.6 sport=36770 dport=21 src=134.76.12.6 dst=192.168.137.190 sport=21 dport=36770 [ASSURED] mark=0 use=1
root@debian:~# conntrack -L expect
conntrack v1.4.4 (conntrack-tools): 0 expectations have been shown.

root@debian:~# dmesg | grep $((119*256 + 52))
[  215.963217] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31844 DF PROTO=TCP SPT=54334 DPT=30516 WINDOW=29200 RES=0x00 SYN URGP=0 

Full log:

root@debian:~# uname -a
Linux debian 4.9.0-1-amd64 #1 SMP Debian 4.9.6-3 (2017-01-28) x86_64 GNU/Linux
root@debian:~# uptime # freshly rebooted
 11:20:30 up 5 min,  3 users,  load average: 0.00, 0.02, 0.00
root@debian:~# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
root@debian:~# lsmod | grep ipt
iptable_filter         16384  0
ip_tables              24576  1 iptable_filter
x_tables               36864  2 ip_tables,iptable_filter
root@debian:~# modprobe ip_conntrack_ftp
root@debian:~# lsmod | grep ip_
ip_tables              24576  1 iptable_filter
x_tables               36864  2 ip_tables,iptable_filter
root@debian:~# lsmod | grep conntr
nf_conntrack_ftp       20480  0
nf_conntrack          114688  1 nf_conntrack_ftp
root@debian:~# cat b
# Generated by iptables-save v1.6.0 on Sun Feb 12 11:17:04 2017
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [7:532]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j LOG
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -j LOG
COMMIT
# Completed on Sun Feb 12 11:17:04 2017
root@debian:~# iptables-restore b
root@debian:~# iptables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:21
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4

michael@debian:~$ ftp ftp.gwdg.de
Connected to ftp6.gwdg.de.
220 Welcome to ftp.gwdg.de
Name (ftp.gwdg.de:michael): ftp
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> passive
Passive mode on.
ftp> ls
227 Entering Passive Mode (134,76,12,6,119,52).
[hang]

root@debian:~# conntrack -L
tcp      6 431965 ESTABLISHED src=192.168.137.190 dst=134.76.12.6 sport=36770 dport=21 src=134.76.12.6 dst=192.168.137.190 sport=21 dport=36770 [ASSURED] mark=0 use=1
root@debian:~# conntrack -L expect
conntrack v1.4.4 (conntrack-tools): 0 expectations have been shown.

root@debian:~# dmesg | grep $((119*256 + 52))
[  215.963217] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31844 DF PROTO=TCP SPT=54334 DPT=30516 WINDOW=29200 RES=0x00 SYN URGP=0 
[  216.981438] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31845 DF PROTO=TCP SPT=54334 DPT=30516 WINDOW=29200 RES=0x00 SYN URGP=0 
[  218.996037] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31846 DF PROTO=TCP SPT=54334 DPT=30516 WINDOW=29200 RES=0x00 SYN URGP=0 
[  223.124663] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31847 DF PROTO=TCP SPT=54334 DPT=30516 WINDOW=29200 RES=0x00 SYN URGP=0 
[  231.315490] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31848 DF PROTO=TCP SPT=54334 DPT=30516 WINDOW=29200 RES=0x00 SYN URGP=0 
[  247.440650] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31849 DF PROTO=TCP SPT=54334 DPT=30516 WINDOW=29200 RES=0x00 SYN URGP=0 
[  281.228684] IN= OUT=eth0 SRC=192.168.137.190 DST=134.76.12.6 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31850 DF PROTO=TCP SPT=54334 DPT=30516 WINDOW=29200 RES=0x00 SYN URGP=0 
-- 
Thanks,
Michael

Re: Restrictive FTP egress using conntrack helper

[Michael Weiser]

Hi Pascal,

On Sun, Feb 12, 2017 at 10:14:08AM +0100, Pascal Hambourg wrote:

> What has changed in recent kernels is that by default the helper is no more
> automatically associated to the "master" connection. You must do so
> explicitly with the 'CT' target, or change the default setting with some
> sysctl or module parameter I forgot about.

> I fail to retrieve the information page I had read about this change, but
> this one contains useful information :
> <https://home.regit.org/netfilter-en/secure-use-of-helpers/>

That page cleared it up: The default for
/proc/sys/net/netfilter/nf_conntrack_helper seems to be 0 nowadays,
effectively disabling all conntrack helpers by default. Because of that
I have to explicitly assign the helper to certain kinds of packets I
wish it to inspect. In my case (egress) this needs to be a rule such as:

iptables -A OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp

With that change my firewall now behaves as expected: The data
connection is considered as RELATED and permitted by the catch-all
--state ESTABLISHED,RELATED -j ACCEPT rule.

As the article states, I shall think about further narrowing that
blanket permission for helper-assisted connections.

What's bugging me is that I still don't see an expectation being
created with conntrack -L expect.
-- 
Thanks!
Michael

Re: Restrictive FTP egress using conntrack helper

[Pablo Neira Ayuso]

On Sun, Feb 12, 2017 at 01:30:52PM +0100, Michael Weiser wrote:
[...]
> What's bugging me is that I still don't see an expectation being
> created with conntrack -L expect.

It's very unlikely to see FTP expectation via conntrack -L since they
are created and destroyed very quickly if you are testing with a FTP
client.

You can probably watch it there by manually creating a connection via
netcat, and talk FTP, eg.

 $ nc ftp.netfilter.org 21
 220 ProFTPD 1.3.5 Server (netfilter/iptables FTP site) [::ffff:150.214.142.16 ]
 USER anonymous
 331 Anonymous login ok, send your complete email address as your password
 PASS nothing
 PASV

# conntrack -L expect
299 proto=6 src=192.168.2.195 dst=150.214.142.167 sport=0 dport=49926 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.2.195 master-dst=150.214.142.167 sport=46532 dport=21 class=0 helper=ftp
conntrack v1.4.4 (conntrack-tools): 1 expectations have been shown.

So `conntrack -E expect' is likely a better option for the debugging
purposes you need.

Re: Restrictive FTP egress using conntrack helper

[Michael Weiser]

Hi Pablo,

On Sun, Feb 12, 2017 at 03:19:40PM +0100, Pablo Neira Ayuso wrote:

> > What's bugging me is that I still don't see an expectation being
> > created with conntrack -L expect.
> It's very unlikely to see FTP expectation via conntrack -L since they
> are created and destroyed very quickly if you are testing with a FTP
> client.

I thought so as well and tried to catch it using a while [ 1 ] loop ...

> So `conntrack -E expect' is likely a better option for the debugging
> purposes you need.

... but conntrack -E expect shows it plain as day of course. Thank you!
-- 
Michael