Connections to portmapper over TCP

Connections to portmapper over TCP

[Aleksandar Milivojevic]

Hi,

I've stumbled accross one interesting problem with portmapper.  I have 
rules to allow connections to portmapper.  The connection goes through 
three way handshake, however as soon as handshake is over, packets are 
being dropped by Netfiler.

The relevant rules on host named "client" look something like this 
(edited a bit for clarity):

/sbin/iptables -A OUTPUT -p udp -s client --sport 0:1023
    -d server --dport sunrpc
    -o eth0 -m rpc --rpcs list_of_services -j ACCEPT

/sbin/iptables -A INPUT -p udp -s server --sport sunrpc
    -d client --dport 0:1023
    -i eth0 -m state --state ESTABLISHED -j ACCEPT

/sbin/iptables -A OUTPUT -p tcp -s client --sport 0:1023
    -d server --dport sunrpc
    -o eth0 -m rpc --rpcs list_of_services -j ACCEPT

/sbin/iptables -A INPUT -p tcp -s server --sport sunrpc
    -d client --dport 0:1023
    -i eth0 -m state --state ESTABLISHED -j ACCEPT

So, this should allow for both TCP and UDP connections to portmapper on 
host "server".  It should also allow me to allow only connections to 
specified RPC services in subsequent rules.  Well, UDP part works.  But 
TCP doesn't work exactly as expected.

I've added some logging rules that will log all portmapper packets with 
either "RPC UDP" or "RPC TCP" prefix, and placed them before above 
mentioned rules.  Also added logging rules that will log dropped packets 
with "OUTPUT" or "INPUT" prefix (depending in which chain they were 
dropped) and placed them at the very end of my rules, just before the 
unmatched packets are dropped by default policy.

What I can see from log files is that three way handshake goes well. 
Edited and formated a bit for clarity:

RPC TCP IN= OUT=eth0 SRC=client DST=server
     LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=11551 DF
     PROTO=TCP SPT=690 DPT=111 WINDOW=5840 RES=0x00 SYN URGP=0

RPC TCP IN=eth0 OUT= SRC=server DST=client
     LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=12081 DF
     PROTO=TCP SPT=111 DPT=690 WINDOW=33304 RES=0x00 ACK SYN URGP=0

RPC TCP IN= OUT=eth0 SRC=client DST=server
     LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=49320 DF
     PROTO=TCP SPT=690 DPT=111 WINDOW=5840 RES=0x00 ACK URGP=0

However, all subsequent packets are being dropped (this two lines are 
for the same packet, logged as it entered the chain, and again just 
before it was dropped by default policy):

RPC TCP IN= OUT=eth0 SRC=client DST=server
     LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=25452 DF
     PROTO=TCP SPT=690 DPT=111 WINDOW=5840 RES=0x00 ACK PSH URGP=0

OUTPUT IN= OUT=eth0 SRC=client DST=server
     LEN=96 TOS=0x00 PREC=0x00 TTL=64 ID=25452 DF
     PROTO=TCP SPT=690 DPT=111 WINDOW=5840 RES=0x00 ACK PSH URGP=0

The above two lines are repeating several times, until client gives up. 
  After that, client fails over to UDP, and from that point on 
everything works as expected.

Using tcpdump basically gives same information (I can see three way 
handshake going on the wire, and after it there's silence).

I've tried adding "-m state --state NEW,ESTABLISHED" to the third line 
of my rules (the one allowing outgoing TCP portmapper requests).  And 
got same results.  For some reason, Netfilter "forgets" that there's 
established connection between cilent and server, and simply starts to 
drop packets.

Has anybody else run across this problem?  Or am I doing something 
obviously wrong?  I've tried digging around in documentation, Googling, 
experimenting, always with the same end result.

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7