netdev - [PATCH] document danger of '-j REJECT'ing of '-m state INVALID' packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200509052235.150348-1-zenczykowski@gmail.com>
Date:   Fri,  8 May 2020 22:22:35 -0700
From:   Maciej Żenczykowski <zenczykowski@...il.com>
To:     Maciej Żenczykowski <maze@...gle.com>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Florian Westphal <fw@...len.de>
Cc:     Linux Network Development Mailing List <netdev@...r.kernel.org>,
        Netfilter Development Mailing List 
        <netfilter-devel@...r.kernel.org>
Subject: [PATCH] document danger of '-j REJECT'ing of '-m state INVALID' packets

From: Maciej Żenczykowski <maze@...gle.com>

This appears to be a common, but hard to debug, misconfiguration.

Signed-off-by: Maciej Żenczykowski <maze@...gle.com>
---
 extensions/libip6t_REJECT.man | 15 +++++++++++++++
 extensions/libipt_REJECT.man  | 15 +++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/extensions/libip6t_REJECT.man b/extensions/libip6t_REJECT.man
index 0030a51f..b6474811 100644
--- a/extensions/libip6t_REJECT.man
+++ b/extensions/libip6t_REJECT.man
@@ -30,3 +30,18 @@ TCP RST packet to be sent back.  This is mainly useful for blocking
 hosts (which won't accept your mail otherwise).
 \fBtcp\-reset\fP
 can only be used with kernel versions 2.6.14 or later.
+.PP
+\fIWarning:\fP if you are using connection tracking and \fBACCEPT\fP'ing
+\fBESTABLISHED\fP (and possibly \fBRELATED\fP) state packets, do not
+indiscriminately \fBREJECT\fP (especially with \fITCP RST\fP) \fBINVALID\fP
+state packets.  Sometimes naturally occuring packet reordering will result
+in packets being considered \fBINVALID\fP and the generated \fITCP RST\fP
+will abort an otherwise healthy connection.
+.P
+Suggested use:
+.br
+    -A INPUT -m state ESTABLISHED,RELATED -j ACCEPT
+.br
+    -A INPUT -m state INVALID -j DROP
+.br
+(and -j REJECT rules go here at the end)
diff --git a/extensions/libipt_REJECT.man b/extensions/libipt_REJECT.man
index 8a360ce7..d0f0f19b 100644
--- a/extensions/libipt_REJECT.man
+++ b/extensions/libipt_REJECT.man
@@ -30,3 +30,18 @@ TCP RST packet to be sent back.  This is mainly useful for blocking
 hosts (which won't accept your mail otherwise).
 .IP
 (*) Using icmp\-admin\-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT
+.PP
+\fIWarning:\fP if you are using connection tracking and \fBACCEPT\fP'ing
+\fBESTABLISHED\fP (and possibly \fBRELATED\fP) state packets, do not
+indiscriminately \fBREJECT\fP (especially with \fITCP RST\fP) \fBINVALID\fP
+state packets.  Sometimes naturally occuring packet reordering will result
+in packets being considered \fBINVALID\fP and the generated \fITCP RST\fP
+will abort an otherwise healthy connection.
+.P
+Suggested use:
+.br
+    -A INPUT -m state ESTABLISHED,RELATED -j ACCEPT
+.br
+    -A INPUT -m state INVALID -j DROP
+.br
+(and -j REJECT rules go here at the end)
-- 
2.26.2.645.ge9eca65c58-goog