[lkml]   [2009]   [Feb]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [BUG] SNAT sometimes allows packets to pass through unchanged
Alan Stern wrote:
> I'm seeing some strange behavior on my firewall, which is running
> Fedora 8's version of 2.6.26. Every so often a packet with a private
> source address is sent out the public interface unchanged, when it
> should be dropped.
> This happens when internal hosts are slow to close their end of a TCP
> connection. For example:
> Internal host A (using a private address) initiates a TCP
> connection to an external server B.
> Data is sent back and forth.
> External host B sends a FIN and host A responds with ACK.
> Several minutes later (after the tracking for this connection
> has expired), host A sends a FIN to host B. This packet
> goes through the firewall unchanged and is sent out the
> public interface with the private source address intact.
> Now I would expect that such packets would be dropped, because they
> don't belong to an existing connection and they can't be the start of a
> new connection. The fact that this doesn't happen indicates there is a
> bug in the netfilter code somewhere.

If the connection has already timed out (from conntracks perspective),
it has lost its state. Unless connection pickup is enabled, the packet
will be marked as INVALID because it doesn't belong to a connection.
You can control dropping of these packets yourself by adding the
appropriate "-m state --state INVALID" rules. That said, there were
some bugs in the past few releases that caused some bad interaction
between TCP and TCP conntrack (not sure anymore which one of both was
to blame). Its possible that this is the root cause for this, so
you might want to consider a kernel update.

 \ /
  Last update: 2009-02-12 06:21    [W:0.089 / U:2.920 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site