* [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards
@ 2012-11-16 14:00 pablo
2012-11-16 14:00 ` [PATCH 1/3] [-stable] netfilter: Mark SYN/ACK packets as invalid from original direction pablo
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: pablo @ 2012-11-16 14:00 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, stable
From: Pablo Neira Ayuso <pablo@netfilter.org>
Hi!
Please, consider the following Netfilter patches for stable 3.0 and
onwards inclusion.
The selected three patches are:
4a70bbf netfilter: Validate the sequence number of dataless ACK packets as well
64f509c netfilter: Mark SYN/ACK packets as invalid from original direction
[BACKPORT] 38fe36a netfilter: nf_nat: don't check for port change on ICMP tuples
The first two patches can be considered security fixes in the TCP connection
tracking to make harder off-path attacks. For more information you can read:
"Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel.
The latter fixes the re-routing of every ICMP packet going through NAT even
if it is not required, which is an expensive operation. That one has been
backported to 3.0.
Please, cherry-pick them. Thanks!
Jozsef Kadlecsik (2):
netfilter: Mark SYN/ACK packets as invalid from original direction
netfilter: Validate the sequence number of dataless ACK packets as well
Ulrich Weber (1):
netfilter: nf_nat: don't check for port change on ICMP tuples
net/ipv4/netfilter/nf_nat_standalone.c | 6 ++++--
net/netfilter/nf_conntrack_proto_tcp.c | 29 ++++++++++-------------------
2 files changed, 14 insertions(+), 21 deletions(-)
--
1.7.10.4
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/3] [-stable] netfilter: Mark SYN/ACK packets as invalid from original direction
2012-11-16 14:00 [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards pablo
@ 2012-11-16 14:00 ` pablo
2012-11-16 14:00 ` [PATCH 2/3] [-stable] netfilter: Validate the sequence number of dataless ACK packets as well pablo
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: pablo @ 2012-11-16 14:00 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, stable
From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Clients should not send such packets. By accepting them, we open
up a hole by wich ephemeral ports can be discovered in an off-path
attack.
See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel,
http://arxiv.org/abs/1201.2074
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_proto_tcp.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 37bf943..1eb458c 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -159,21 +159,18 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
* sCL -> sSS
*/
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */
-/*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
+/*synack*/ { sIV, sIV, sSR, sIV, sIV, sIV, sIV, sIV, sIV, sSR },
/*
* sNO -> sIV Too late and no reason to do anything
* sSS -> sIV Client can't send SYN and then SYN/ACK
* sS2 -> sSR SYN/ACK sent to SYN2 in simultaneous open
- * sSR -> sIG
- * sES -> sIG Error: SYNs in window outside the SYN_SENT state
- * are errors. Receiver will reply with RST
- * and close the connection.
- * Or we are not in sync and hold a dead connection.
- * sFW -> sIG
- * sCW -> sIG
- * sLA -> sIG
- * sTW -> sIG
- * sCL -> sIG
+ * sSR -> sSR Late retransmitted SYN/ACK in simultaneous open
+ * sES -> sIV Invalid SYN/ACK packets sent by the client
+ * sFW -> sIV
+ * sCW -> sIV
+ * sLA -> sIV
+ * sTW -> sIV
+ * sCL -> sIV
*/
/* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */
/*fin*/ { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
--
1.7.10.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/3] [-stable] netfilter: Validate the sequence number of dataless ACK packets as well
2012-11-16 14:00 [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards pablo
2012-11-16 14:00 ` [PATCH 1/3] [-stable] netfilter: Mark SYN/ACK packets as invalid from original direction pablo
@ 2012-11-16 14:00 ` pablo
2012-11-16 14:00 ` [PATCH 3/3] [-stable] netfilter: nf_nat: don't check for port change on ICMP tuples pablo
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: pablo @ 2012-11-16 14:00 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, stable
From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
We spare nothing by not validating the sequence number of dataless
ACK packets and enabling it makes harder off-path attacks.
See: "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel,
http://arxiv.org/abs/1201.2074
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_proto_tcp.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 1eb458c..a9d5f50 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -625,15 +625,9 @@ static bool tcp_in_window(const struct nf_conn *ct,
ack = sack = receiver->td_end;
}
- if (seq == end
- && (!tcph->rst
- || (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
+ if (tcph->rst && seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)
/*
- * Packets contains no data: we assume it is valid
- * and check the ack value only.
- * However RST segments are always validated by their
- * SEQ number, except when seq == 0 (reset sent answering
- * SYN.
+ * RST sent answering SYN.
*/
seq = end = sender->td_end;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 3/3] [-stable] netfilter: nf_nat: don't check for port change on ICMP tuples
2012-11-16 14:00 [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards pablo
2012-11-16 14:00 ` [PATCH 1/3] [-stable] netfilter: Mark SYN/ACK packets as invalid from original direction pablo
2012-11-16 14:00 ` [PATCH 2/3] [-stable] netfilter: Validate the sequence number of dataless ACK packets as well pablo
@ 2012-11-16 14:00 ` pablo
2012-11-20 19:31 ` [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards Greg KH
2012-11-25 13:59 ` Ben Hutchings
4 siblings, 0 replies; 6+ messages in thread
From: pablo @ 2012-11-16 14:00 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, stable
From: Ulrich Weber <ulrich.weber@sophos.com>
ICMP tuples have id in src and type/code in dst.
So comparing src.u.all with dst.u.all will always fail here
and ip_xfrm_me_harder() is called for every ICMP packet,
even if there was no NAT.
This patch is a backport of:
[ 38fe36a netfilter: nf_nat: don't check for port change on ICMP tuples ]
Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/nf_nat_standalone.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 483b76d..b2c3ed7 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -194,7 +194,8 @@ nf_nat_out(unsigned int hooknum,
if ((ct->tuplehash[dir].tuple.src.u3.ip !=
ct->tuplehash[!dir].tuple.dst.u3.ip) ||
- (ct->tuplehash[dir].tuple.src.u.all !=
+ (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+ ct->tuplehash[dir].tuple.src.u.all !=
ct->tuplehash[!dir].tuple.dst.u.all)
)
return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
@@ -230,7 +231,8 @@ nf_nat_local_fn(unsigned int hooknum,
ret = NF_DROP;
}
#ifdef CONFIG_XFRM
- else if (ct->tuplehash[dir].tuple.dst.u.all !=
+ else if (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+ ct->tuplehash[dir].tuple.dst.u.all !=
ct->tuplehash[!dir].tuple.src.u.all)
if (ip_xfrm_me_harder(skb))
ret = NF_DROP;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards
2012-11-16 14:00 [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards pablo
` (2 preceding siblings ...)
2012-11-16 14:00 ` [PATCH 3/3] [-stable] netfilter: nf_nat: don't check for port change on ICMP tuples pablo
@ 2012-11-20 19:31 ` Greg KH
2012-11-25 13:59 ` Ben Hutchings
4 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2012-11-20 19:31 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, davem, stable
On Fri, Nov 16, 2012 at 03:00:11PM +0100, pablo@netfilter.org wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
>
> Hi!
>
> Please, consider the following Netfilter patches for stable 3.0 and
> onwards inclusion.
>
> The selected three patches are:
>
> 4a70bbf netfilter: Validate the sequence number of dataless ACK packets as well
> 64f509c netfilter: Mark SYN/ACK packets as invalid from original direction
> [BACKPORT] 38fe36a netfilter: nf_nat: don't check for port change on ICMP tuples
>
> The first two patches can be considered security fixes in the TCP connection
> tracking to make harder off-path attacks. For more information you can read:
> "Reflection scan: an Off-Path Attack on TCP" by Jan Wrobel.
>
> The latter fixes the re-routing of every ICMP packet going through NAT even
> if it is not required, which is an expensive operation. That one has been
> backported to 3.0.
>
> Please, cherry-pick them. Thanks!
All applied, thanks.
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards
2012-11-16 14:00 [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards pablo
` (3 preceding siblings ...)
2012-11-20 19:31 ` [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards Greg KH
@ 2012-11-25 13:59 ` Ben Hutchings
4 siblings, 0 replies; 6+ messages in thread
From: Ben Hutchings @ 2012-11-25 13:59 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, davem, stable
[-- Attachment #1: Type: text/plain, Size: 369 bytes --]
On Fri, 2012-11-16 at 15:00 +0100, pablo@netfilter.org wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
>
> Hi!
>
> Please, consider the following Netfilter patches for stable 3.0 and
> onwards inclusion.
[...]
All queued up for 3.2, thanks.
Ben.
--
Ben Hutchings
Never attribute to conspiracy what can adequately be explained by stupidity.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-11-25 14:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-11-16 14:00 [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards pablo
2012-11-16 14:00 ` [PATCH 1/3] [-stable] netfilter: Mark SYN/ACK packets as invalid from original direction pablo
2012-11-16 14:00 ` [PATCH 2/3] [-stable] netfilter: Validate the sequence number of dataless ACK packets as well pablo
2012-11-16 14:00 ` [PATCH 3/3] [-stable] netfilter: nf_nat: don't check for port change on ICMP tuples pablo
2012-11-20 19:31 ` [PATCH 0/3] [-stable] Netfilter updates for stable 3.0 onwards Greg KH
2012-11-25 13:59 ` Ben Hutchings
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).