* IPtables and HTTP/2-Push?
@ 2017-09-14 8:42 Walter H.
2017-09-14 10:58 ` Imran Geriskovan
2017-09-17 7:42 ` Walter H.
0 siblings, 2 replies; 4+ messages in thread
From: Walter H. @ 2017-09-14 8:42 UTC (permalink / raw)
To: netfilter
Hello,
when I have these two rules on client side (Browser)
# Allow anything out on WAN
-A OUTPUT -o iface-wan -j ACCEPT
# Allow established, related packets back in
-A INPUT -i iface-wan -m state --state ESTABLISHED,RELATED -j ACCEPT
or on firewalls/routers
# Allow anything out on WAN
-A FORWARD -i iface-lan -o iface-wan -j ACCEPT
# Allow established, related packets back in
-A FORWARD -i iface-wan -o iface-lan -m state --state ESTABLISHED,RELATED
-j ACCEPT
what happens to to packets that the Server pushes without request?
I ask this because I see in the logs regularly a few entries like this
[13-Sep-2017; 16:42:06.415850] IPv6[FWD]: IN=sit1 OUT=br0
SRC=2a00:1450:4001:0811:0000:0000:0000:200e
DST=LANprefix:0000:0000:0000:1234 LEN=123 TC=0 HOPLIMIT=60 FLOWLBL=262223
as I filtered away INVALID, I can imagine, that these blocked packets come
from HTTP/2-Push ...
Am i right?
Greetings,
Walter
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: IPtables and HTTP/2-Push?
2017-09-14 8:42 IPtables and HTTP/2-Push? Walter H.
@ 2017-09-14 10:58 ` Imran Geriskovan
2017-09-14 12:24 ` Walter H.
2017-09-17 7:42 ` Walter H.
1 sibling, 1 reply; 4+ messages in thread
From: Imran Geriskovan @ 2017-09-14 10:58 UTC (permalink / raw)
To: Walter H.; +Cc: netfilter
On 9/14/17, Walter H. <walter.h@mathemainzel.info> wrote:
> Hello,
> when I have these two rules on client side (Browser)
> or on firewalls/routers
> what happens to to packets that the Server pushes without request?
> I ask this because I see in the logs regularly a few entries like this
> as I filtered away INVALID, I can imagine, that these blocked packets come
> from HTTP/2-Push ...
> Am i right?
As far as I know http2 pushes content over already open tcp
connections. So I guess that invalid packets are probably unrelated
to http2.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: IPtables and HTTP/2-Push?
2017-09-14 10:58 ` Imran Geriskovan
@ 2017-09-14 12:24 ` Walter H.
0 siblings, 0 replies; 4+ messages in thread
From: Walter H. @ 2017-09-14 12:24 UTC (permalink / raw)
To: Imran Geriskovan; +Cc: netfilter
On Thu, September 14, 2017 12:58, Imran Geriskovan wrote:
> On 9/14/17, Walter H. <walter.h@mathemainzel.info> wrote:
>> Hello,
>> when I have these two rules on client side (Browser)
>> or on firewalls/routers
>> what happens to to packets that the Server pushes without request?
>> I ask this because I see in the logs regularly a few entries like this
>> as I filtered away INVALID, I can imagine, that these blocked packets
>> come
>> from HTTP/2-Push ...
>> Am i right?
>
> As far as I know http2 pushes content over already open tcp
> connections.
connection vs. packet?
> So I guess that invalid packets are probably unrelated
> to http2.
these can't be invalid, as invalid packets got dropped before ...
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: IPtables and HTTP/2-Push?
2017-09-14 8:42 IPtables and HTTP/2-Push? Walter H.
2017-09-14 10:58 ` Imran Geriskovan
@ 2017-09-17 7:42 ` Walter H.
1 sibling, 0 replies; 4+ messages in thread
From: Walter H. @ 2017-09-17 7:42 UTC (permalink / raw)
To: netfilter
[-- Attachment #1: Type: text/plain, Size: 1344 bytes --]
On 14.09.2017 10:42, Walter H. wrote:
> Hello,
>
> when I have these two rules on client side (Browser)
>
> # Allow anything out on WAN
> -A OUTPUT -o iface-wan -j ACCEPT
> # Allow established, related packets back in
> -A INPUT -i iface-wan -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> or on firewalls/routers
>
> # Allow anything out on WAN
> -A FORWARD -i iface-lan -o iface-wan -j ACCEPT
> # Allow established, related packets back in
> -A FORWARD -i iface-wan -o iface-lan -m state --state ESTABLISHED,RELATED
> -j ACCEPT
>
>
> what happens to to packets that the Server pushes without request?
>
> I ask this because I see in the logs regularly a few entries like this
>
> [13-Sep-2017; 16:42:06.415850] IPv6[FWD]: IN=sit1 OUT=br0
> SRC=2a00:1450:4001:0811:0000:0000:0000:200e
> DST=LANprefix:0000:0000:0000:1234 LEN=123 TC=0 HOPLIMIT=60 FLOWLBL=262223
>
> as I filtered away INVALID, I can imagine, that these blocked packets come
> from HTTP/2-Push ...
>
> Am i right?
>
> Greetings,
> Walter
>
p.s. this is not limited to IPv6,
also IPv4
e.g.
[17-Sep-2017; 08:42:21.259878] IP[IN]: IN=eth1 OUT=
MAC=24:xx:xx:xx:xx:24:24:xx:xx:xx:xx:24:08:00 SRC=151.101.112.188
DST=#WAN-IP# LEN=115 TOS=0x00 PREC=0x00 TTL=59 ID=63615 DF PROTO=TCP
SPT=443 DPT=53156 WINDOW=57 RES=0x00 ACK PSH URGP=0
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 3491 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-09-17 7:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-09-14 8:42 IPtables and HTTP/2-Push? Walter H.
2017-09-14 10:58 ` Imran Geriskovan
2017-09-14 12:24 ` Walter H.
2017-09-17 7:42 ` Walter H.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox