tcp conn tracking

tcp conn tracking

[Anil Gunturu]

Hi,
Does the tcp connection tracking reorder and reassemble the tcp data. I am particularly interested in how ip_conntrack_ftp works, if the tcp data for port commnad comes in two different out-of-order segments.
Thanks,
-Anil

Re: tcp conn tracking

[Jozsef Kadlecsik]

On Sun, 14 Jan 2007, Anil Gunturu wrote:

> Does the tcp connection tracking reorder and reassemble the tcp data. I 
> am particularly interested in how ip_conntrack_ftp works, if the tcp 
> data for port commnad comes in two different out-of-order segments.

The connection tracking in netfilter defragments fragmented packets but 
does not reorder out of order packets. Moreover FTP connection tracking 
won't work on PORT/etc commands which arrive in multiple (not fragmented) 
packets, even if those are in order.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
           H-1525 Budapest 114, POB. 49, Hungary

Re: tcp conn tracking

[Anil Gunturu]

Thank you for the response. 

So, ftp connection tracking doesn't work always. Just curious about what is the rationale for such a solution? Is it assumed that if the packet with PORT command is fragmented someone is deliberatly attacking the system?

Cheers,

-Anil

----- Original Message -----
From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
To: Anil Gunturu <anil@mistletoetech.com>
Cc: netfilter@lists.netfilter.org
Sent: Sunday, January 14, 2007 11:47:23 PM GMT-0800 US/Pacific
Subject: Re: tcp conn tracking

On Sun, 14 Jan 2007, Anil Gunturu wrote:

> Does the tcp connection tracking reorder and reassemble the tcp data. I 
> am particularly interested in how ip_conntrack_ftp works, if the tcp 
> data for port commnad comes in two different out-of-order segments.

The connection tracking in netfilter defragments fragmented packets but 
does not reorder out of order packets. Moreover FTP connection tracking 
won't work on PORT/etc commands which arrive in multiple (not fragmented) 
packets, even if those are in order.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
           H-1525 Budapest 114, POB. 49, Hungary

Re: tcp conn tracking

[Jan Engelhardt]

>So, ftp connection tracking doesn't work always. Just curious about 
>what is the rationale for such a solution? Is it assumed that if the 
>packet with PORT command is fragmented someone is deliberatly attacking 
>the system?

Yes you can assume that. FTP commands are usually not that long to not 
fit into a small packet.


	-`J'
-- 

Re: tcp conn tracking

[Anil Gunturu]

OK. Does the same thing apply to ftp when NAT is involved? If the port command comes fragmented and out-of-order, and the conntrack module doesn't reassemble the packets, the "inside" ip address goes out untranslated. Is this considered a security breach.

Cheers,

-Anil

----- Original Message -----
From: Jan Engelhardt <jengelh@linux01.gwdg.de>
To: Anil Gunturu <anil@mistletoetech.com>
Cc: netfilter@lists.netfilter.org, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Sent: Monday, January 15, 2007 8:59:48 AM GMT-0800 US/Pacific
Subject: Re: tcp conn tracking


>So, ftp connection tracking doesn't work always. Just curious about 
>what is the rationale for such a solution? Is it assumed that if the 
>packet with PORT command is fragmented someone is deliberatly attacking 
>the system?

Yes you can assume that. FTP commands are usually not that long to not 
fit into a small packet.


        -`J'
-- 

Re: tcp conn tracking

[Jozsef Kadlecsik]

On Mon, 15 Jan 2007, Anil Gunturu wrote:

> OK. Does the same thing apply to ftp when NAT is involved? If the port 
> command comes fragmented and out-of-order, and the conntrack module 
> doesn't reassemble the packets, the "inside" ip address goes out 
> untranslated. Is this considered a security breach.

[Please do not top-post. Thanks.]

NAT is built on top of conntrack. So fragmented packets get defragmented 
before processing but out of order packets are not reordered by netfilter.

A deliberate attacker can force to break up PORT commands and PASV 
responses to be carried in multiple non-fragmented packets and those then 
"slip through" without NATing. However what can be gained by this? 
Conntrack cannot detect the IP address/port so the data channel won't be 
"opened up" by conntrack. The attacker can discover the real IP address of 
the other side, that's all. NAT is not meant to be a security solution.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
           H-1525 Budapest 114, POB. 49, Hungary

Re: tcp conn tracking

[Grant Taylor]

Jozsef Kadlecsik wrote:
> "... NAT is not meant to be a security solution. ..."

Indeed NAT in and of its self is not a security solution.  That being 
said, quite often the obscurity that it provides is erroneously used as 
a (basic) security solution.



Grant. . . .