Commit 775ada6d authored by Jesper Dangaard Brouer's avatar Jesper Dangaard Brouer Committed by Pablo Neira Ayuso

netfilter: more strict TCP flag matching in SYNPROXY

Its seems Patrick missed to incoorporate some of my requested changes
during review v2 of SYNPROXY netfilter module.

Which were, to avoid SYN+ACK packets to enter the path, meant for the
ACK packet from the client (from the 3WHS).

Further there were a bug in ip6t_SYNPROXY.c, for matching SYN packets
that didn't exclude the ACK flag.

Go a step further with SYN packet/flag matching by excluding flags
ACK+FIN+RST, in both IPv4 and IPv6 modules.

The intented usage of SYNPROXY is as follows:
(gracefully describing usage in commit)

 iptables -t raw -A PREROUTING -i eth0 -p tcp --dport 80 --syn -j NOTRACK
 iptables -A INPUT -i eth0 -p tcp --dport 80 -m state UNTRACKED,INVALID \
         -j SYNPROXY --sack-perm --timestamp --mss 1480 --wscale 7 --ecn

 echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose

This does filter SYN flags early, for packets in the UNTRACKED state,
but packets in the INVALID state with other TCP flags could still
reach the module, thus this stricter flag matching is still needed.
Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 5a17a390
...@@ -269,7 +269,7 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par) ...@@ -269,7 +269,7 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
synproxy_parse_options(skb, par->thoff, th, &opts); synproxy_parse_options(skb, par->thoff, th, &opts);
if (th->syn && !th->ack) { if (th->syn && !(th->ack || th->fin || th->rst)) {
/* Initial SYN from client */ /* Initial SYN from client */
this_cpu_inc(snet->stats->syn_received); this_cpu_inc(snet->stats->syn_received);
...@@ -285,7 +285,7 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par) ...@@ -285,7 +285,7 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
XT_SYNPROXY_OPT_ECN); XT_SYNPROXY_OPT_ECN);
synproxy_send_client_synack(skb, th, &opts); synproxy_send_client_synack(skb, th, &opts);
} else if (th->ack && !(th->fin || th->rst)) } else if (th->ack && !(th->fin || th->rst || th->syn))
/* ACK from client */ /* ACK from client */
synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq)); synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
......
...@@ -284,7 +284,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par) ...@@ -284,7 +284,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
synproxy_parse_options(skb, par->thoff, th, &opts); synproxy_parse_options(skb, par->thoff, th, &opts);
if (th->syn) { if (th->syn && !(th->ack || th->fin || th->rst)) {
/* Initial SYN from client */ /* Initial SYN from client */
this_cpu_inc(snet->stats->syn_received); this_cpu_inc(snet->stats->syn_received);
...@@ -300,7 +300,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par) ...@@ -300,7 +300,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
XT_SYNPROXY_OPT_ECN); XT_SYNPROXY_OPT_ECN);
synproxy_send_client_synack(skb, th, &opts); synproxy_send_client_synack(skb, th, &opts);
} else if (th->ack && !(th->fin || th->rst)) } else if (th->ack && !(th->fin || th->rst || th->syn))
/* ACK from client */ /* ACK from client */
synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq)); synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment