Re: [PATCH 4/4] drop ftp bounce attacks

[Patrick McHardy <kaber@trash.net>]

Philip Craig wrote:
> On 05/25/2006 02:31 AM, Patrick McHardy wrote:
> 
>>The best solution would be to mark the packet INVALID and let the
>>user decide using the state match.
> 
> 
> Marking the packet INVALID is definitely better than always dropping
> it.
> 
> The reason I said fixing the ftp server is the best solution is
> that I'm not sure whether the ftp conntrack module can match on
> all possible port commands, taking into account fragmentation,
> reordering, and retransmits.
> 
> This is different from attacks against the firewall, in which the
> attack works only if the firewall recognizes the port command and
> creates an expectation.


Absolutely. I actually made a quite similar patch because of the
same reason (certification requirements), but in the end I don't
think its very useful for the reasons you mention above and because
this is absolutely not what connection tracking helpers are meant
for, people should use application layer proxies for this.