[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Bug in ipnat?
IPFilter-3.4.17 is the latest version and is supposed to not have this bug.
OpenBSD-2.9 ships with v. 3.4.16 with patches which are supposed to fix
the bug. Either downgrade to 2.7, upgrade to 2.9 or try to patch with
3.4.17 (and I have no idea whether that will succeed or not).
On Friday 04 May 2001 05:44 am, mag@tech.sibal.ru wrote:
> Hi, hackers.
>
> I have one problem with IPfilter.
> Probably there are bugs in ipnat.
>
>
> Description
>
>
> My Internet connection
>
> 212.188.36.2 (fxp1)
> +-----------------------+
> Internet---| gateway with IPfilter |
> +-----------------------+
>
> | 192.168.164.5 (fxp0)
> | 192.168.164.6
>
> +-----------------------+
>
> | Host inside |
>
> +-----------------------+
>
>
> Configuration of the gateway with IPfilter
>
> # ipnat -l
> List of active MAP/Redirect filters:
> map fxp1 192.168.0.0/16 -> 0.0.0.0/32 proxy port ftp ftp/tcp
> map fxp1 172.16.0.0/12 -> 0.0.0.0/32 proxy port ftp ftp/tcp
> map fxp1 10.0.0.0/8 -> 0.0.0.0/32 proxy port ftp ftp/tcp
> map fxp1 192.168.0.0/16 -> 0.0.0.0/32 portmap tcp/udp 16384:32767
> map fxp1 192.168.0.0/16 -> 0.0.0.0/32
> map fxp1 172.16.0.0/12 -> 0.0.0.0/32 portmap tcp/udp 16384:32767
> map fxp1 172.16.0.0/12 -> 0.0.0.0/32
> map fxp1 10.0.0.0/8 -> 0.0.0.0/32 portmap tcp/udp 16384:32767
> map fxp1 10.0.0.0/8 -> 0.0.0.0/32
>
> List of active sessions:
> ...
>
>
> # ipfstat -io
> pass out from any to any
> pass in from any to any
>
>
> # ipf -V
> ipf: IP Filter: v3.3.18 (184)
> Kernel: IP Filter: v3.3.18
> Running: yes
> Log Flags: 0 = none set
> Default: block all, Logging: available
> Active list: 0
>
>
> # OS
> OpenBSD-2.8 i386 with all patches up to April 23 2001 applied.
>
>
> # ifconfig -A
> lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 32972
> inet 127.0.0.1 netmask 0xff000000
> lo1: flags=8008<LOOPBACK,MULTICAST> mtu 32972
> fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> media: Ethernet autoselect (100baseTX full-duplex)
> status: active
> inet 192.168.164.6 netmask 0xfffffffc broadcast 192.168.164.7
> fxp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
> media: Ethernet autoselect (100baseTX full-duplex)
> status: active
> inet 212.188.36.2 netmask 0xffffffe0 broadcast 212.188.36.31
>
>
> # netstat -rn
> Routing tables
>
> Internet:
> Destination Gateway Flags Refs Use Mtu
> Interface default 212.188.36.1 UGS 2 19314
> 1500 fxp1 10/8 192.168.164.5 UGS 0 0
> 1500 fxp0 127/8 127.0.0.1 UGRS 0 0
> 32972 lo0 127.0.0.1 127.0.0.1 UH 2 42
> 32972 lo0 172.16/12 192.168.164.5 UGS 0 0
> 1500 fxp0 192.168/16 192.168.164.5 UGS 2 36655
> 1500 fxp0 192.168.164.4/30 link#1 UC 0 0
> 1500 fxp0 192.168.164.5 0:4:ac:58:56:1 UHL 3 97
> 1500 fxp0 192.168.164.6 127.0.0.1 UGHS 0 0
> 32972 lo0 212.188.36.0/27 link#2 UC 0 0
> 1500 fxp1 212.188.36.1 0:2:16:64:70:3f UHL 1 68
> 1500 fxp1 224/4 127.0.0.1 URS 0 0
> 32972 lo0
>
> Encap:
> Source Port Destination Port Proto
> SA(Address/Proto/Type/Direction)
>
>
> Problem on the Host inside
>
> # traceroute -n -q 1 www.ru
> traceroute to www.ru (194.87.0.50), 30 hops max, 40 byte packets
> 1 192.168.164.6 0.180 ms
> 2 *
> 3 *
> 4 *
> 5 *
> 6 *
> 7 *
> 8 *
> 9 *
> 10 *
> 11 *
>
>
> Packet dumps on the network interfaces of the gateway with IPfilter
>
> tcpdump: listening on fxp0
> 13:48:50.212769 192.168.164.5.34204 > 194.87.0.50.33435: [no cksum] udp
> 12 [ttl 1] (id 34205) 13:48:50.212928 192.168.164.6 > 192.168.164.5:
> icmp: time exceeded in-transit (ttl 255, id 45396) 13:48:50.213648
> 192.168.164.5.34204 > 194.87.0.50.33436: [no cksum] udp 12 (ttl 2, id
> 34206) 13:48:55.222130 192.168.164.5.34204 > 194.87.0.50.33437: [no
> cksum] udp 12 (ttl 3, id 34207) 13:49:00.232539 192.168.164.5.34204 >
> 194.87.0.50.33438: [no cksum] udp 12 (ttl 4, id 34208) 13:49:05.242933
> 192.168.164.5.34204 > 194.87.0.50.33439: [no cksum] udp 12 (ttl 5, id
> 34209) 13:49:10.253345 192.168.164.5.34204 > 194.87.0.50.33440: [no
> cksum] udp 12 (ttl 6, id 34210) 13:49:15.263855 192.168.164.5.34204 >
> 194.87.0.50.33441: [no cksum] udp 12 (ttl 7, id 34211) 13:49:20.274204
> 192.168.164.5.34204 > 194.87.0.50.33442: [no cksum] udp 12 (ttl 8, id
> 34212) 13:49:25.284556 192.168.164.5.34204 > 194.87.0.50.33443: [no
> cksum] udp 12 (ttl 9, id 34213) 13:49:30.294960 192.168.164.5.34204 >
> 194.87.0.50.33444: [no cksum] udp 12 (ttl 10, id 34214) 13:49:35.305368
> 192.168.164.5.34204 > 194.87.0.50.33445: [no cksum] udp 12 (ttl 11, id
> 34215)
>
> tcpdump: listening on fxp1
> 13:48:50.213678 212.188.36.2.16462 > 194.87.0.50.33436: [no cksum] udp
> 12 [ttl 1] (id 34206) 13:48:50.214326 212.188.36.1 > 212.188.36.2: icmp:
> time exceeded in-transit [tos 0xc0] (ttl 255, id 61891) 13:48:55.222174
> 212.188.36.2.16463 > 194.87.0.50.33437: [no cksum] udp 12 (ttl 2, id
> 34207) 13:48:55.227157 212.188.43.97 > 212.188.36.2: icmp: time exceeded
> in-transit [tos 0xc0] (ttl 254, id 29540) 13:49:00.232586
> 212.188.36.2.16464 > 194.87.0.50.33438: [no cksum] udp 12 (ttl 3, id
> 34208) 13:49:00.237924 195.34.52.66 > 212.188.36.2: icmp: time exceeded
> in-transit [tos 0xc0] (ttl 253, id 51778) 13:49:05.242970
> 212.188.36.2.16465 > 194.87.0.50.33439: [no cksum] udp 12 (ttl 4, id
> 34209) 13:49:05.249307 212.30.177.106 > 212.188.36.2: icmp: time exceeded
> in-transit [tos 0xc0] (ttl 252, id 44346) 13:49:10.253403
> 212.188.36.2.16466 > 194.87.0.50.33440: [no cksum] udp 12 (ttl 5, id
> 34210) 13:49:10.261012 193.232.244.35 > 212.188.36.2: icmp: time exceeded
> in-transit [tos 0xc0] (ttl 251, id 64887) 13:49:15.263895
> 212.188.36.2.16467 > 194.87.0.50.33441: [no cksum] udp 12 (ttl 6, id
> 34211) 13:49:15.272142 194.87.0.86 > 212.188.36.2: icmp: time exceeded
> in-transit [tos 0xc0] (ttl 250, id 15343) 13:49:20.274247
> 212.188.36.2.16468 > 194.87.0.50.33442: [no cksum] udp 12 (ttl 7, id
> 34212) 13:49:20.281983 194.87.0.50 > 212.188.36.2: icmp: 194.87.0.50 udp
> port 33442 unreachable (DF) (ttl 249, id 60603) 13:49:25.284599
> 212.188.36.2.16469 > 194.87.0.50.33443: [no cksum] udp 12 (ttl 8, id
> 34213) 13:49:25.292199 194.87.0.50 > 212.188.36.2: icmp: 194.87.0.50 udp
> port 33443 unreachable (DF) (ttl 249, id 60604) 13:49:30.295006
> 212.188.36.2.16470 > 194.87.0.50.33444: [no cksum] udp 12 (ttl 9, id
> 34214) 13:49:30.302254 194.87.0.50 > 212.188.36.2: icmp: 194.87.0.50 udp
> port 33444 unreachable (DF) (ttl 249, id 60605) 13:49:35.305427
> 212.188.36.2.16471 > 194.87.0.50.33445: [no cksum] udp 12 (ttl 10, id
> 34215) 13:49:35.312344 194.87.0.50 > 212.188.36.2: icmp: 194.87.0.50 udp
> port 33445 unreachable (DF) (ttl 249, id 60606)
>
>
> Conclusion
>
> The gateway with IPfilter does not pass ICMP messages
> ("time exceeded" and "port unreachable") from the Internet to inside.
> Also maybe that this gateway does not pass other ICMP messages
> ("parameter problem", "source quench", "destination unreacheable") too.
> Note: ping works fine.
> I think that there are bugs in ipnat. Any comments?
>
> --
> Alexei Malinin,
> System Administrator of
> Siberian Aluminium Group