* Re: unclean module handling of UDP packets with no checksum broken?
@ 2002-09-20 1:04 Mark Warren
2002-09-20 1:09 ` DISREGARD - " Mark Warren
0 siblings, 1 reply; 2+ messages in thread
From: Mark Warren @ 2002-09-20 1:04 UTC (permalink / raw)
To: netfilter-devel
Hi,
It seems that the unclean module's handling of UDP packets with no
checksum may be broken. Per RFC768, UDP packets are not required to use
checksums. In the case that they don't, the checksum field of the UDP
header should contain all 0s. The following ipt_unclean.c code causes
such packets to be silently (unless you configure your firewall to log
matches to this rule) discarded:
/* Bad checksum? Don't print, just say it's unclean. */
/* FIXME: SRC ROUTE packets won't match checksum --RR */
if (!more_frags &&
!embedded &&
csum_tcpudp_magic(iph->saddr, iph->daddr, datalen,
IPPROTO_UDP,
csum_partial((char *)udph, datalen, 0))
!= 0)
return 0;
I'm wondering if this is desired behavior or if this is a bug. I
have come across a problem where legitimate and well formed packets are
being dropped by this code. Some Cisco IOS versions (particularly older
Cisco DistributedDirector IOS) don't use checksums in UDP packets. Some
features allow you to turn on checksums, others don't. The Director
feature doesn't. I'm not sure how many other real-world applications
behave this way.
Thanks!
- Mark Warren
ps: i appologize if this has been discussed before. i searched through
the list archives, but was unable to find anything relevant to this subject.
-- Analysis --
#
# Packet dump of DNS packet from a DistributedDirector:
#
<snip>
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 74 bytes
IP: Identification = 20292
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 245 seconds/hops
IP: Protocol = 17 (UDP)
IP: Header checksum = e488
IP: Source address = 205.181.115.167, 205.181.115.167
IP: Destination address = 171.78.165.42, 171.78.165.42
IP: No options
IP:
UDP: ----- UDP Header -----
UDP:
UDP: Source port = 53
UDP: Destination port = 34145
UDP: Length = 54
UDP: Checksum = 0000 (no checksum)
UDP:
DNS: ----- DNS Header -----
<snip>
#
# rules to test
# 205.181.115.167 is a DistributedDirector that runs older code that
# does not use UDP checksums.
# 4.2.35.31 is a DistributedDirector that runs newer code that does
#
iptables -N MWUNCLEAN
iptables -A INPUT -i eth1 -p udp -s 205.181.115.167 -m unclean \
-j MWUNCLEAN
iptables -A INPUT -i eth1 -p udp -s 4.2.35.31 -m unclean \
-j MWUNCLEAN
iptables -A MWUNCLEAN -j LOG --log-level info \
--log-prefix "MWUNCLEAN -- DROP " --log-tcp-options \
--log-ip-options
iptables -A MWUNCLEAN -j DROP
#
# I modified the unclean module source to log the fact that it was
# dropping packets due to this code, and include the results of
# csum_tcpudp_magic().
#
<snip>
#define limpk(format, args...) \
do { \
if (net_ratelimit()) \
printk(KERN_EMERG "ipt_unclean: %s" format, \
embedded ? "(embedded packet) " : "" , ## args); \
} while(0)
<snip>
/* Bad checksum? Don't print, just say it's unclean. */
/* FIXME: SRC ROUTE packets won't match checksum --RR */
if (!more_frags && !embedded &&
csum_tcpudp_magic(iph->saddr, iph->daddr, datalen, IPPROTO_UDP,
csum_partial((char *)udph, datalen, 0)) != 0)
{
limpk("UDP checksum failed (0x%x)\n",
csum_tcpudp_magic(iph->saddr, iph->daddr, datalen,
IPPROTO_UDP, csum_partial((char *)udph, datalen, 0)));
return 0;
}
<snip>
#
# Testing against my kernel/module modifications
#
[root@forty-two rc.d]# dig @205.181.115.167 a.vaid.host.name A +norecurs
; <<>> DiG 9.2.1 <<>> @205.181.115.167 a.valid.host.name A +norecurs
;; global options: printcmd
;; connection timed out; no servers could be reached
[root@forty-two netfilter]# dig @4.2.35.31 a.valid.host.name A +norecurs
; <<>> DiG 9.2.1 <<>> @4.2.35.31 a.valid.host.name A +norecurs
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21791
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;a.valid.host.name. IN A
;; ANSWER SECTION:
a.valid.host.name. 60 IN A 10.0.0.1
;; Query time: 813 msec
;; SERVER: 4.2.35.31#53(4.2.35.31)
;; WHEN: Wed Sep 18 11:55:08 2002
;; MSG SIZE rcvd: 50
#
# Yielded the following logs
#
[root@forty-two log]# grep 205.18 messages
Sep 18 10:31:48 forty-two kernel: MWUNCLEAN -- DROP IN=eth1 OUT=
MAC=00:10:5a:0c:60:1f:00:30:19:72:b5:8c:08:00 SRC=205.181.115.167 DST=2
4.128.239.65 LEN=74 TOS=0x00 PREC=0x00 TTL=240 ID=71 PROTO=UDP SPT=53
DPT=32805 LEN=54
Sep 18 15:47:24 forty-two kernel: ipt_unclean: UDP checksum failed (0x909b)
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: DISREGARD - unclean module handling of UDP packets with no checksum broken?
2002-09-20 1:04 unclean module handling of UDP packets with no checksum broken? Mark Warren
@ 2002-09-20 1:09 ` Mark Warren
0 siblings, 0 replies; 2+ messages in thread
From: Mark Warren @ 2002-09-20 1:09 UTC (permalink / raw)
To: netfilter-devel
d'oh! My appologies, I spoke too soon. I found the patch submission
for this problem in the list archives.
Sorry!
- Mark Warren
Mark Warren wrote:
> Hi,
> It seems that the unclean module's handling of UDP packets with no
> checksum may be broken. Per RFC768, UDP packets are not required to use
> checksums. In the case that they don't, the checksum field of the UDP
> header should contain all 0s. The following ipt_unclean.c code causes
> such packets to be silently (unless you configure your firewall to log
> matches to this rule) discarded:
>
> /* Bad checksum? Don't print, just say it's unclean. */
> /* FIXME: SRC ROUTE packets won't match checksum --RR */
> if (!more_frags &&
> !embedded &&
> csum_tcpudp_magic(iph->saddr, iph->daddr, datalen,
> IPPROTO_UDP,
> csum_partial((char *)udph, datalen, 0))
> != 0)
>
> return 0;
>
> I'm wondering if this is desired behavior or if this is a bug. I have
> come across a problem where legitimate and well formed packets are being
> dropped by this code. Some Cisco IOS versions (particularly older Cisco
> DistributedDirector IOS) don't use checksums in UDP packets. Some
> features allow you to turn on checksums, others don't. The Director
> feature doesn't. I'm not sure how many other real-world applications
> behave this way.
>
> Thanks!
> - Mark Warren
>
> ps: i appologize if this has been discussed before. i searched through
> the list archives, but was unable to find anything relevant to this
> subject.
>
> -- Analysis --
> #
> # Packet dump of DNS packet from a DistributedDirector:
> #
> <snip>
> IP: ----- IP Header -----
> IP:
> IP: Version = 4
> IP: Header length = 20 bytes
> IP: Type of service = 0x00
> IP: xxx. .... = 0 (precedence)
> IP: ...0 .... = normal delay
> IP: .... 0... = normal throughput
> IP: .... .0.. = normal reliability
> IP: Total length = 74 bytes
> IP: Identification = 20292
> IP: Flags = 0x0
> IP: .0.. .... = may fragment
> IP: ..0. .... = last fragment
> IP: Fragment offset = 0 bytes
> IP: Time to live = 245 seconds/hops
> IP: Protocol = 17 (UDP)
> IP: Header checksum = e488
> IP: Source address = 205.181.115.167, 205.181.115.167
> IP: Destination address = 171.78.165.42, 171.78.165.42
> IP: No options
> IP:
> UDP: ----- UDP Header -----
> UDP:
> UDP: Source port = 53
> UDP: Destination port = 34145
> UDP: Length = 54
> UDP: Checksum = 0000 (no checksum)
> UDP:
> DNS: ----- DNS Header -----
> <snip>
>
> #
> # rules to test
> # 205.181.115.167 is a DistributedDirector that runs older code that
> # does not use UDP checksums.
> # 4.2.35.31 is a DistributedDirector that runs newer code that does
> #
> iptables -N MWUNCLEAN
> iptables -A INPUT -i eth1 -p udp -s 205.181.115.167 -m unclean \
> -j MWUNCLEAN
> iptables -A INPUT -i eth1 -p udp -s 4.2.35.31 -m unclean \
> -j MWUNCLEAN
> iptables -A MWUNCLEAN -j LOG --log-level info \
> --log-prefix "MWUNCLEAN -- DROP " --log-tcp-options \
> --log-ip-options
> iptables -A MWUNCLEAN -j DROP
>
> #
> # I modified the unclean module source to log the fact that it was
> # dropping packets due to this code, and include the results of
> # csum_tcpudp_magic().
> #
> <snip>
> #define limpk(format, args...) \
> do { \
> if (net_ratelimit()) \
> printk(KERN_EMERG "ipt_unclean: %s" format, \
> embedded ? "(embedded packet) " : "" , ## args); \
> } while(0)
> <snip>
> /* Bad checksum? Don't print, just say it's unclean. */
> /* FIXME: SRC ROUTE packets won't match checksum --RR */
> if (!more_frags && !embedded &&
> csum_tcpudp_magic(iph->saddr, iph->daddr, datalen, IPPROTO_UDP,
> csum_partial((char *)udph, datalen, 0)) != 0)
> {
>
> limpk("UDP checksum failed (0x%x)\n",
> csum_tcpudp_magic(iph->saddr, iph->daddr, datalen,
> IPPROTO_UDP, csum_partial((char *)udph, datalen, 0)));
>
> return 0;
> }
> <snip>
>
> #
> # Testing against my kernel/module modifications
> #
> [root@forty-two rc.d]# dig @205.181.115.167 a.vaid.host.name A +norecurs
>
> ; <<>> DiG 9.2.1 <<>> @205.181.115.167 a.valid.host.name A +norecurs
> ;; global options: printcmd
> ;; connection timed out; no servers could be reached
>
> [root@forty-two netfilter]# dig @4.2.35.31 a.valid.host.name A +norecurs
>
> ; <<>> DiG 9.2.1 <<>> @4.2.35.31 a.valid.host.name A +norecurs
> ;; global options: printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21791
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;a.valid.host.name. IN A
>
> ;; ANSWER SECTION:
> a.valid.host.name. 60 IN A 10.0.0.1
>
> ;; Query time: 813 msec
> ;; SERVER: 4.2.35.31#53(4.2.35.31)
> ;; WHEN: Wed Sep 18 11:55:08 2002
> ;; MSG SIZE rcvd: 50
>
> #
> # Yielded the following logs
> #
> [root@forty-two log]# grep 205.18 messages
> Sep 18 10:31:48 forty-two kernel: MWUNCLEAN -- DROP IN=eth1 OUT=
> MAC=00:10:5a:0c:60:1f:00:30:19:72:b5:8c:08:00 SRC=205.181.115.167 DST=2
> 4.128.239.65 LEN=74 TOS=0x00 PREC=0x00 TTL=240 ID=71 PROTO=UDP SPT=53
> DPT=32805 LEN=54
> Sep 18 15:47:24 forty-two kernel: ipt_unclean: UDP checksum failed (0x909b)
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2002-09-20 1:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-09-20 1:04 unclean module handling of UDP packets with no checksum broken? Mark Warren
2002-09-20 1:09 ` DISREGARD - " Mark Warren
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.