linux-kernel - Re: [ 16/48] netfilter: conntrack: disable generic tracking for known protocols

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1431723913.6315.128.camel@decadent.org.uk>
Date:	Fri, 15 May 2015 22:05:13 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Willy Tarreau <w@....eu>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Florian Westphal <fw@...len.de>,
	Daniel Borkmann <dborkman@...hat.com>,
	Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>,
	Pablo Neira Ayuso <pablo@...filter.org>
Subject: Re: [ 16/48] netfilter: conntrack: disable generic tracking for
 known protocols

On Fri, 2015-05-15 at 10:05 +0200, Willy Tarreau wrote:
> 2.6.32-longterm review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Florian Westphal <fw@...len.de>
> 
> commit db29a9508a9246e77087c5531e45b2c88ec6988b upstream
> 
> Given following iptables ruleset:
> 
> -P FORWARD DROP
> -A FORWARD -m sctp --dport 9 -j ACCEPT
> -A FORWARD -p tcp --dport 80 -j ACCEPT
> -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT
> 
> One would assume that this allows SCTP on port 9 and TCP on port 80.
> Unfortunately, if the SCTP conntrack module is not loaded, this allows
> *all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT,
> which we think is a security issue.
> 
> This is because on the first SCTP packet on port 9, we create a dummy
> "generic l4" conntrack entry without any port information (since
> conntrack doesn't know how to extract this information).
> 
> All subsequent packets that are unknown will then be in established
> state since they will fallback to proto_generic and will match the
> 'generic' entry.
> 
> Our originally proposed version [1] completely disabled generic protocol
> tracking, but Jozsef suggests to not track protocols for which a more
> suitable helper is available, hence we now mitigate the issue for in
> tree known ct protocol helpers only, so that at least NAT and direction
> information will still be preserved for others.
> 
>  [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html
> 
> Joint work with Daniel Borkmann.
> 
> Signed-off-by: Florian Westphal <fw@...len.de>
> Signed-off-by: Daniel Borkmann <dborkman@...hat.com>
> Acked-by: Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>
> [bwh: Backported to 2.6.32: adjust context]

Signed-off-by: Ben Hutchings <ben@...adent.org.uk>

> Signed-off-by: Willy Tarreau <w@....eu>
[...]

-- 
Ben Hutchings
It is impossible to make anything foolproof because fools are so ingenious.

Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)