netdev - Re: [BUG] SNAT sometimes allows packets to pass through unchanged

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 16 Feb 2009 11:41:50 -0500 (EST)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Patrick McHardy <kaber@...sh.net>
cc:	netdev@...r.kernel.org,
	Kernel development list <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] SNAT sometimes allows packets to pass through unchanged

On Mon, 16 Feb 2009, Patrick McHardy wrote:

> Alan Stern wrote:
> > On Mon, 16 Feb 2009, Patrick McHardy wrote:
> > 
> >>> I tried adding a rule to log these unaccounted-for packets.  Nothing 
> >>> showed up, even when I could see the packets being sent.
> >> Where (table/chain/position) did you add this rule?
> > 
> > In the first position of the POSTROUTING chain in the nat table.  I
> > don't remember exactly what rules I used, but at one point I tried
> > something very much like this:
> > 
> > iptables -t nat -I POSTROUTING 1 -s 10.0.0.0/8 -p tcp ! --syn
> > 
> > The counter for this rule remained at 0 even after packets with private 
> > source addresses were sent through the public interface.
> 
> The NAT table only sees the first packet of every connection
> and never INVALID packets. The mangle table should work fine.

Okay, I'll try it instead.  Are these facts documented anywhere?  FWIW, 
I don't recall ever seeing anywhere a description of what packets go 
through the mangle table, or at what stage of processing.

> You can also enable conntrack-internal logging of invalid packets:
> 
> echo 255 >/proc/sys/net/netfilter/nf_conntrack_log_invalid

I did this (except I used the value of IPPROTO_TCP instead of 255).  
Several things did get logged, but no messages were produced for the
packets I'm concerned about.  _That_ definitely seemed like a bug...

> > I tried using 2 6.27 kernel but the problem remained.  Building a later 
> > version won't be easy because of the need to create the proper config.  
> > Can you remember in which version these bugs got fixed?
> 
> Sorry, no.

Hm.  Maybe I'll try to set up a test system with a 2.6.29-rc kernel, to 
see if the problem really has been fixed yet.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html