Allowing closed connections time to drain before logging packets

Allowing closed connections time to drain before logging packets

[Brian J. Murrell]

[-- Attachment #1: Type: text/plain, Size: 812 bytes --]

I often see entries such as this being logged in my system log:

IN=ens3 OUT= MAC=[redacted] SRC=[redacted] DST=10.75.26.3 LEN=74 TOS=0x00 PREC=0x00 TTL=43 ID=3769 DF PROTO=TCP SPT=33944 DPT=22 WINDOW=229 RES=0x00 ACK PSH URGP=0

I suspect these are packets that come straggling in after a TCP
connection has been shut down.  Is there any way to have netfilter give
recently shut down TCP connections a bit of grace time before logging
packets that have been sent after they were shut down, just to reduce
the false-positive noise in my logs?

Same goes for UDP in fact:

IN=eth0.2 OUT= MAC=[redacted] SRC=[reacted, remote IP] DST=[redacted, my local IP] LEN=99 TOS=0x00 PREC=0x00 TTL=59 ID=0 DF PROTO=UDP SPT=443 DPT=37242 LEN=79 MARK=0x3f00

for, for example, QUIC connections.

Cheers,
b.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Allowing closed connections time to drain before logging packets

[Slavko]

Dňa 25. septembra 2024 17:09:38 UTC používateľ "Brian J. Murrell" <brian@interlinx.bc.ca> napísal:

You can consider to extend netfilter connection timeouts.

>IN=ens3 OUT= MAC=[redacted] SRC=[redacted] DST=10.75.26.3 LEN=74 TOS=0x00 PREC=0x00 TTL=43 ID=3769 DF PROTO=TCP SPT=33944 DPT=22 WINDOW=229 RES=0x00 ACK PSH URGP=0

You have two options with TCP:

+ setup kernel knob to consider NEW packet without SYN
as invalid and drop INVALID packets
+ drop NEW TCP packets without SYN by exact FW rule

Both drops do before log rule...

>IN=eth0.2 OUT= MAC=[redacted] SRC=[reacted, remote IP] DST=[redacted, my local IP] LEN=99 TOS=0x00 PREC=0x00 TTL=59 ID=0 DF PROTO=UDP SPT=443 DPT=37242 LEN=79 MARK=0x3f00

A little complicated with UDP, but the same logic, drop NEW
UDP packets by exact rule after accept of ESTABLISHED and
open ports rules, but before log rule...

For both (TCP/UDP) consider to add more conditions, as sport,
ephemeral dports, etc...

regards


-- 
Slavko
https://www.slavino.sk/

Re: Allowing closed connections time to drain before logging packets

[Brian J. Murrell]

On Wed, 2024-09-25 at 18:18 +0000, Slavko wrote:
> 
> You can consider to extend netfilter connection timeouts.

This seems like the ideal solution.  But which timeout would I extend
to keep a connection valid for some period of time after netfilter has
seen the close of a (TCP for example) session?

> You have two options with TCP:
> 
> + setup kernel knob to consider NEW packet without SYN
> as invalid and drop INVALID packets

But I do want to continue to log and drop otherwise (other than for
very recently closed session) INVALID packets.  I just don't want
packets that are from a connection that was recently closed to be
considered INVALID.

> + drop NEW TCP packets without SYN by exact FW rule

But I don't want to drop all/any TCP packets without a SYN if they were
never part of a recently closed session.  I still want to log port
probing for example.

> A little complicated with UDP,

If there is a timeout after a closed "session" before it's considered
INVALID, it shouldn't be any more complicated for UDP than TCP since
both have concepts of VALID/ACTIVE and INVALID sessions.  They just
consider when they are "closed" differently (i.e. TCP with FIN packets
and UDP after a timeout of connection idleness).


> For both (TCP/UDP) consider to add more conditions, as sport,
> ephemeral dports, etc...

There are no more conditions I can add that help determine if packets
are part of a recently closed session or not, AFAIU.

Cheers,
b.

Re: Allowing closed connections time to drain before logging packets

[Pablo Neira Ayuso]

On Wed, Sep 25, 2024 at 01:09:38PM -0400, Brian J. Murrell wrote:
> I often see entries such as this being logged in my system log:
> 
> IN=ens3 OUT= MAC=[redacted] SRC=[redacted] DST=10.75.26.3 LEN=74 TOS=0x00 PREC=0x00 TTL=43 ID=3769 DF PROTO=TCP SPT=33944 DPT=22 WINDOW=229 RES=0x00 ACK PSH URGP=0
> 
> I suspect these are packets that come straggling in after a TCP
> connection has been shut down.  Is there any way to have netfilter give
> recently shut down TCP connections a bit of grace time before logging
> packets that have been sent after they were shut down, just to reduce
> the false-positive noise in my logs?

These are packets logged through 'ct state invalid', right?

> Same goes for UDP in fact:
> 
> IN=eth0.2 OUT= MAC=[redacted] SRC=[reacted, remote IP] DST=[redacted, my local IP] LEN=99 TOS=0x00 PREC=0x00 TTL=59 ID=0 DF PROTO=UDP SPT=443 DPT=37242 LEN=79 MARK=0x3f00
> 
> for, for example, QUIC connections.
> 
> Cheers,
> b.
> 

Re: Allowing closed connections time to drain before logging packets

[Brian J. Murrell]

On Mon, 2024-09-30 at 11:51 +0200, Pablo Neira Ayuso wrote:
> 
> These are packets logged through 'ct state invalid', right?

Yes, I would say that is a reasonable statement.  But they are only
just recently invalid, as of the closing of the valid "session" just a
few packets before.

So while I want to still log generally invalid packets (i.e. an ACK-
only packet not part of an existing session, or an RST not part of a an
actively closing session, etc.), I don't want to log packets that are
only invalid because they are "stragglers" (i.e. were delayed in the
network, etc. and only arrive after the close of the session) from a
recently (let's say, 30 or maybe even 60 seconds since) closed session.

Cheers,
b.