1025ce7521
Luca Moro says: ------ The issue lies in the filtering of ICMP and ICMPv6 errors that include an inner IP datagram. For these packets, icmp_error_message() extract the ICMP error and inner layer to search of a known state. If a state is found the packet is tagged as related (IP_CT_RELATED). The problem is that there is no correlation check between the inner and outer layer of the packet. So one can encapsulate an error with an inner layer matching a known state, while its outer layer is directed to a filtered host. In this case the whole packet will be tagged as related. This has various implications from a rule bypass (if a rule to related trafic is allow), to a known state oracle. Unfortunately, we could not find a real statement in a RFC on how this case should be filtered. The closest we found is RFC5927 (Section 4.3) but it is not very clear. A possible fix would be to check that the inner IP source is the same than the outer destination. We believed this kind of attack was not documented yet, so we started to write a blog post about it. You can find it attached to this mail (sorry for the extract quality). It contains more technical details, PoC and discussion about the identified behavior. We discovered later that https://www.gont.com.ar/papers/filtering-of-icmp-error-messages.pdf described a similar attack concept in 2004 but without the stateful filtering in mind. ----- This implements above suggested fix: In icmp(v6) error handler, take outer destination address, then pass that into the common function that does the "related" association. After obtaining the nf_conn of the matching inner-headers connection, check that the destination address of the opposite direction tuple is the same as the outer address and only set RELATED if thats the case. Reported-by: Luca Moro <luca.moro@synacktiv.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
226 lines
6.8 KiB
C
226 lines
6.8 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Header for use in defining a given L4 protocol for connection tracking.
|
|
*
|
|
* 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
|
|
* - generalized L3 protocol dependent part.
|
|
*
|
|
* Derived from include/linux/netfiter_ipv4/ip_conntrack_protcol.h
|
|
*/
|
|
|
|
#ifndef _NF_CONNTRACK_L4PROTO_H
|
|
#define _NF_CONNTRACK_L4PROTO_H
|
|
#include <linux/netlink.h>
|
|
#include <net/netlink.h>
|
|
#include <net/netfilter/nf_conntrack.h>
|
|
#include <net/netns/generic.h>
|
|
|
|
struct seq_file;
|
|
|
|
struct nf_conntrack_l4proto {
|
|
/* L4 Protocol number. */
|
|
u_int8_t l4proto;
|
|
|
|
/* Resolve clashes on insertion races. */
|
|
bool allow_clash;
|
|
|
|
/* protoinfo nlattr size, closes a hole */
|
|
u16 nlattr_size;
|
|
|
|
/* called by gc worker if table is full */
|
|
bool (*can_early_drop)(const struct nf_conn *ct);
|
|
|
|
/* convert protoinfo to nfnetink attributes */
|
|
int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla,
|
|
struct nf_conn *ct);
|
|
|
|
/* convert nfnetlink attributes to protoinfo */
|
|
int (*from_nlattr)(struct nlattr *tb[], struct nf_conn *ct);
|
|
|
|
int (*tuple_to_nlattr)(struct sk_buff *skb,
|
|
const struct nf_conntrack_tuple *t);
|
|
/* Calculate tuple nlattr size */
|
|
unsigned int (*nlattr_tuple_size)(void);
|
|
int (*nlattr_to_tuple)(struct nlattr *tb[],
|
|
struct nf_conntrack_tuple *t);
|
|
const struct nla_policy *nla_policy;
|
|
|
|
struct {
|
|
int (*nlattr_to_obj)(struct nlattr *tb[],
|
|
struct net *net, void *data);
|
|
int (*obj_to_nlattr)(struct sk_buff *skb, const void *data);
|
|
|
|
u16 obj_size;
|
|
u16 nlattr_max;
|
|
const struct nla_policy *nla_policy;
|
|
} ctnl_timeout;
|
|
#ifdef CONFIG_NF_CONNTRACK_PROCFS
|
|
/* Print out the private part of the conntrack. */
|
|
void (*print_conntrack)(struct seq_file *s, struct nf_conn *);
|
|
#endif
|
|
};
|
|
|
|
bool icmp_pkt_to_tuple(const struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
struct net *net,
|
|
struct nf_conntrack_tuple *tuple);
|
|
|
|
bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
struct net *net,
|
|
struct nf_conntrack_tuple *tuple);
|
|
|
|
bool nf_conntrack_invert_icmp_tuple(struct nf_conntrack_tuple *tuple,
|
|
const struct nf_conntrack_tuple *orig);
|
|
bool nf_conntrack_invert_icmpv6_tuple(struct nf_conntrack_tuple *tuple,
|
|
const struct nf_conntrack_tuple *orig);
|
|
|
|
int nf_conntrack_inet_error(struct nf_conn *tmpl, struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
const struct nf_hook_state *state,
|
|
u8 l4proto,
|
|
union nf_inet_addr *outer_daddr);
|
|
|
|
int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,
|
|
struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
const struct nf_hook_state *state);
|
|
|
|
int nf_conntrack_icmpv6_error(struct nf_conn *tmpl,
|
|
struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
const struct nf_hook_state *state);
|
|
|
|
int nf_conntrack_icmp_packet(struct nf_conn *ct,
|
|
struct sk_buff *skb,
|
|
enum ip_conntrack_info ctinfo,
|
|
const struct nf_hook_state *state);
|
|
|
|
int nf_conntrack_icmpv6_packet(struct nf_conn *ct,
|
|
struct sk_buff *skb,
|
|
enum ip_conntrack_info ctinfo,
|
|
const struct nf_hook_state *state);
|
|
|
|
int nf_conntrack_udp_packet(struct nf_conn *ct,
|
|
struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
enum ip_conntrack_info ctinfo,
|
|
const struct nf_hook_state *state);
|
|
int nf_conntrack_udplite_packet(struct nf_conn *ct,
|
|
struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
enum ip_conntrack_info ctinfo,
|
|
const struct nf_hook_state *state);
|
|
int nf_conntrack_tcp_packet(struct nf_conn *ct,
|
|
struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
enum ip_conntrack_info ctinfo,
|
|
const struct nf_hook_state *state);
|
|
int nf_conntrack_dccp_packet(struct nf_conn *ct,
|
|
struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
enum ip_conntrack_info ctinfo,
|
|
const struct nf_hook_state *state);
|
|
int nf_conntrack_sctp_packet(struct nf_conn *ct,
|
|
struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
enum ip_conntrack_info ctinfo,
|
|
const struct nf_hook_state *state);
|
|
int nf_conntrack_gre_packet(struct nf_conn *ct,
|
|
struct sk_buff *skb,
|
|
unsigned int dataoff,
|
|
enum ip_conntrack_info ctinfo,
|
|
const struct nf_hook_state *state);
|
|
|
|
void nf_conntrack_generic_init_net(struct net *net);
|
|
void nf_conntrack_tcp_init_net(struct net *net);
|
|
void nf_conntrack_udp_init_net(struct net *net);
|
|
void nf_conntrack_gre_init_net(struct net *net);
|
|
void nf_conntrack_dccp_init_net(struct net *net);
|
|
void nf_conntrack_sctp_init_net(struct net *net);
|
|
void nf_conntrack_icmp_init_net(struct net *net);
|
|
void nf_conntrack_icmpv6_init_net(struct net *net);
|
|
|
|
/* Existing built-in generic protocol */
|
|
extern const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic;
|
|
|
|
#define MAX_NF_CT_PROTO IPPROTO_UDPLITE
|
|
|
|
const struct nf_conntrack_l4proto *nf_ct_l4proto_find(u8 l4proto);
|
|
|
|
/* Generic netlink helpers */
|
|
int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
|
|
const struct nf_conntrack_tuple *tuple);
|
|
int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
|
|
struct nf_conntrack_tuple *t);
|
|
unsigned int nf_ct_port_nlattr_tuple_size(void);
|
|
extern const struct nla_policy nf_ct_port_nla_policy[];
|
|
|
|
#ifdef CONFIG_SYSCTL
|
|
__printf(3, 4) __cold
|
|
void nf_ct_l4proto_log_invalid(const struct sk_buff *skb,
|
|
const struct nf_conn *ct,
|
|
const char *fmt, ...);
|
|
__printf(5, 6) __cold
|
|
void nf_l4proto_log_invalid(const struct sk_buff *skb,
|
|
struct net *net,
|
|
u16 pf, u8 protonum,
|
|
const char *fmt, ...);
|
|
#else
|
|
static inline __printf(5, 6) __cold
|
|
void nf_l4proto_log_invalid(const struct sk_buff *skb, struct net *net,
|
|
u16 pf, u8 protonum, const char *fmt, ...) {}
|
|
static inline __printf(3, 4) __cold
|
|
void nf_ct_l4proto_log_invalid(const struct sk_buff *skb,
|
|
const struct nf_conn *ct,
|
|
const char *fmt, ...) { }
|
|
#endif /* CONFIG_SYSCTL */
|
|
|
|
static inline struct nf_generic_net *nf_generic_pernet(struct net *net)
|
|
{
|
|
return &net->ct.nf_ct_proto.generic;
|
|
}
|
|
|
|
static inline struct nf_tcp_net *nf_tcp_pernet(struct net *net)
|
|
{
|
|
return &net->ct.nf_ct_proto.tcp;
|
|
}
|
|
|
|
static inline struct nf_udp_net *nf_udp_pernet(struct net *net)
|
|
{
|
|
return &net->ct.nf_ct_proto.udp;
|
|
}
|
|
|
|
static inline struct nf_icmp_net *nf_icmp_pernet(struct net *net)
|
|
{
|
|
return &net->ct.nf_ct_proto.icmp;
|
|
}
|
|
|
|
static inline struct nf_icmp_net *nf_icmpv6_pernet(struct net *net)
|
|
{
|
|
return &net->ct.nf_ct_proto.icmpv6;
|
|
}
|
|
|
|
#ifdef CONFIG_NF_CT_PROTO_DCCP
|
|
static inline struct nf_dccp_net *nf_dccp_pernet(struct net *net)
|
|
{
|
|
return &net->ct.nf_ct_proto.dccp;
|
|
}
|
|
#endif
|
|
|
|
#ifdef CONFIG_NF_CT_PROTO_SCTP
|
|
static inline struct nf_sctp_net *nf_sctp_pernet(struct net *net)
|
|
{
|
|
return &net->ct.nf_ct_proto.sctp;
|
|
}
|
|
#endif
|
|
|
|
#ifdef CONFIG_NF_CT_PROTO_GRE
|
|
static inline struct nf_gre_net *nf_gre_pernet(struct net *net)
|
|
{
|
|
return &net->ct.nf_ct_proto.gre;
|
|
}
|
|
#endif
|
|
|
|
#endif /*_NF_CONNTRACK_PROTOCOL_H*/
|