Re: IPFilter 4.1.33

As that solution points out, the sniffer point of view can be
wrong due to hardware checksum offload - i.e. turn it off for
the tests, to make sure.

I think that you can try testing whether ipfilter is breaking
your packets/frames by loading it up with an empty set of rules,
or with ruleset like
   pass in quick all
   pass out quick all

As I wrote earlier, on my system whenever ipf module is loaded
and the ruleset is flushed or set even to allow-all example
above, the system disappears from traceroutes. I can "ping"
it however.

Concerning your problem, I have actually hit it with a Cisco
firewall sometime back. The problem is that your packets are
broadcasts, but your rulesets below seem to specify only the
specific subnet numbers.

In Cisco notation, the relevant working access-list rule
permissions look like:

access-list 100 remark -- Permit DHCP on Magistral
access-list 100 permit udp any any eq bootps
access-list 100 permit udp any eq bootps any
access-list 100 permit udp any any eq bootpc
access-list 100 permit udp any eq bootpc any

Hopefully, It won't take you over a minute to translate
these rules to ipf ;)

HTH,
//Jim

Steve Clark wrote:
> On 08/22/2009 07:19 AM, Jim Klimov wrote:
>> I guess I figured it out somewhat, and searching the very
>> old archives did play a part in this.
>>
>> http://www.mail-archive.com/[email protected]/msg07513.html
>>
>> The tcpdump problems are cosmetic and related to hardware
>> checksum offloading. However, even after setting the flag
>> to zero and rebooting, the problem persists as in the
>> reproduction scenario quoted below.
>>
>> That is, tcpdump on the router host no longer complains
>> about checksums in most cases, but some still persist i.e.
>>
>> 15:17:11.448413 08:00:27:f6:dc:bd>  00:e0:81:5e:9f:cb, ethertype
>> IPv4 (0x0800), length 60: (tos 0x0, ttl   1, id 32159, offset 0,
>> flags [none], proto: ICMP (1), length: 40) 192.168.186.250>
>> 194.67.183.19: ICMP echo request, id 33306, seq 0, length 20
>>
>> 15:17:11.448450 00:e0:81:5e:9f:cb>  08:00:27:f6:dc:bd, ethertype
>> IPv4 (0x0800), length 82: truncated-ip - 17340 bytes missing!
>> (tos 0x0, ttl 255, id 39119, offset 512, flags [none],
>> proto: ICMP (1), length: 17408, bad cksum ec9a (->e89e)!)
>> 192.168.186.2>  192.168.186.250: icmp
>>
>> So I'm back into debugging the networking setup.
>>
>> Jim Klimov wrote:
>>> I forgot to mention that, like before, this system is a Sun
>>> Fire X2100 (pre-M2) server with an nge and a bge couple of
>>> interfaces, so most of OS interfaces are VLANs. The one in
>>> question as the external connection certainly is, bge126000.
>>>
>>> Maybe some hardcoded offset stuff breaks when Ethernet VLAN
>>> tag bytes come into play?
>>>
>>> Jim Klimov wrote:
>>>> Hello Darren et al,
>>>>
>>>> I think I have a de-ja-vu again: with IPF 4.1.33 active my
>>>> firewall does not respond to pings while tracing through it.
>>>>
>>>> This happens specifically after the rules are touched by
>>>> the driver, i.e. reproduction:
>>>> 1) /etc/init.d/ipfilter stop
>>>>     - module is unloaded, my router responds to tracert
>>>> 2) modload /usr/kernel/drv/ipf
>>>>     - host still responds
>>>> 3) ipf -Fy
>>>>     - host stops responding even while the rule list is empty
>>>>     When I load rules which pass all packets in and out, host
>>>>     is still out of the traces.
>>>>
>>>> Since other hosts "around" it respond to traces, it may be
>>>> that packets entering and exiting the system are mangled
>>>> in a similar manner, and packets originating or terminating
>>>> on the host are only mangled once - so they break. However
>>>> SSH to the machine works well, so there's something deeper
>>>> than that.
>>>>
>>>> Seems this also breaks NAT. At the very least, it is not
>>>> working for me now (but packets don't panic the kernel
>>>> either, which is an improvement compared to my previous
>>>> experimental builds).
>>>>
>>>> 16:45:28.354506 IP (tos 0x0, ttl 127, id 1150, offset 0,
>>>> flags [DF], proto: TCP (6), length: 48) 93.175.31.2.1821
>>>>   >  193.169.34.3.22107: S, cksum 0x957f (correct),
>>>> 738265398:738265398(0) win 64240<mss 1366,nop,nop,sackOK>
>>>>
>>>> 16:45:28.500340 IP (tos 0x0, ttl  64, id 42280, offset 0,
>>>> flags [DF], proto: TCP (6), length: 40, bad cksum 0 (->354a)!)
>>>> 93.175.31.2.1821>  193.169.34.3.22107: R, cksum 0x0000
>>>> (incorrect (->  0xbcd2), 738265399:738265399(0) win 0
>>>>
>>>
>>>
>>
>>
> 
> 
> Hi Jim,
> 
> I am using IPFilter 4.1.32 on CentOS 5.3 linux kernel2.6.18-128.1.10.el5
> 
> Did you figure anything out on this:
>> 15:17:11.448450 00:e0:81:5e:9f:cb>  08:00:27:f6:dc:bd, ethertype
>> IPv4 (0x0800), length 82: truncated-ip - 17340 bytes missing!
>> (tos 0x0, ttl 255, id 39119, offset 512, flags [none],
>> proto: ICMP (1), length: 17408, bad cksum ec9a (->e89e)!)
>> 192.168.186.2>  192.168.186.250: icmp
> 
> I seeing a similar problem with bootp responses and dhclient it discarding
> the response so I can't pull an address with ipf on.
> 
> 
> /sbin/dhclient -cf /etc/dhclient.conf
> Internet Systems Consortium DHCP Client V3.0.5-RedHat
> Copyright 2004-2006 Internet Systems Consortium.
> All rights reserved.
> For info, please visit http://www.isc.org/sw/dhcp/
> 
> reason is PREINIT
> interface is eth1
> /etc/foxbox-dhclient-script: PREINIT for eth1
> oldip is 192.168.198.178
> Listening on LPF/eth1/00:02:b6:36:97:9f
> Sending on   LPF/eth1/00:02:b6:36:97:9f
> Sending on   Socket/fallback
> DHCPREQUEST on eth1 to 255.255.255.255 port 67
> DHCPREQUEST on eth1 to 255.255.255.255 port 67
> DHCPREQUEST on eth1 to 255.255.255.255 port 67
> DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 4
> DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 10
> 5 bad IP checksums seen in 5 packets
> DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 8
> DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 14
> DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 12
> DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 10
> 5 bad IP checksums seen in 5 packets
> DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 3
> No DHCPOFFERS received.
> Trying recorded lease 192.168.198.178
> reason is TIMEOUT
> interface is eth1
> /etc/foxbox-dhclient-script: TIMEOUT for eth1
> 
> [root@Z2966 ~]# tcpdump -nlvvi eth1 port 67 or port 68
> tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 96 
> bytes
> 10:15:58.095208 IP (tos 0x10, ttl  16, id 0, offset 0, flags [none], 
> proto: UDP (17), length: 328) 0.0.0.0.bootpc > 255.255.255.255.bootps: 
> BOOTP/DHCP, Request from 00:02:b6:36:97:9f, length: 300, xid:0xe549556a, 
> flags: [none] (0x0000)
>           Client Ethernet Address: 00:02:b6:36:97:9f [|bootp]
> 10:15:58.095922 IP truncated-ip - 23205 bytes missing! (tos 0x0, ttl 
> 128, id 27103, offset 0, flags [none], proto: UDP (17), length: 23553, 
> bad cksum 48c3 (->ee1d)!) 192.168.198.70.bootps > 
> 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length: 23525, 
> xid:0xe549556a, flags: [none] (0x0000)
>           Your IP: 192.168.198.178
>           Client Ethernet Address: 00:02:b6:36:97:9f [|bootp]
> 10:16:01.003339 IP (tos 0x10, ttl  16, id 0, offset 0, flags [none], 
> proto: UDP (17), length: 328) 0.0.0.0.bootpc > 255.255.255.255.bootps: 
> BOOTP/DHCP, Request from 00:02:b6:36:97:9f, length: 300, xid:0xe549556a, 
> secs:3, flags: [none] (0x0000)
>           Client Ethernet Address: 00:02:b6:36:97:9f [|bootp]
> 10:16:01.003851 IP truncated-ip - 23205 bytes missing! (tos 0x0, ttl 
> 128, id 27115, offset 0, flags [none], proto: UDP (17), length: 23553, 
> bad cksum 48b7 (->ee11)!) 192.168.198.70.bootps > 
> 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length: 23525, 
> xid:0xe549556a, flags: [none] (0x0000)
>           Your IP: 192.168.198.178
>           Client Ethernet Address: 00:02:b6:36:97:9f [|bootp]
> 10:16:05.064004 IP truncated-ip - 19635 bytes missing! (tos 0x0, ttl 
> 128, id 0, offset 0, flags [none], proto: UDP (17), length: 19969, bad 
> cksum 39a0 (->ecec)!) 0.0.0.0.bootpc > 255.255.255.255.bootps: 
> BOOTP/DHCP, Request from 00:1e:68:5e:b2:5f, length: 19941, 
> xid:0x56f3cba3, flags: [Broadcast] (0x8000)
>           Client Ethernet Address: 00:1e:68:5e:b2:5f [|bootp]
> 
> 
> 
> Now with ipfilter off via ipf -Fa:
> 
> /sbin/dhclient -cf /etc/dhclient.conf
> Internet Systems Consortium DHCP Client V3.0.5-RedHat
> Copyright 2004-2006 Internet Systems Consortium.
> All rights reserved.
> For info, please visit http://www.isc.org/sw/dhcp/
> 
> reason is PREINIT
> interface is eth1
> /etc/foxbox-dhclient-script: PREINIT for eth1
> oldip is 192.168.198.178
> Listening on LPF/eth1/00:02:b6:36:97:9f
> Sending on   LPF/eth1/00:02:b6:36:97:9f
> Sending on   Socket/fallback
> DHCPREQUEST on eth1 to 255.255.255.255 port 67
> DHCPACK from 192.168.198.70
> reason is REBOOT
> interface is eth1
> /etc/foxbox-dhclient-script: REBOOT for eth1
> oldip is 192.168.198.178
> /etc/foxbox-dhclient-script: IP Address 192.168.198.178
> /etc/foxbox-dhclient-script: Subnet Mask 255.255.255.0
> /etc/foxbox-dhclient-script: Default Router 192.168.198.252
> /etc/foxbox-dhclient-script: DNS Servers 192.168.198.70 192.168.198.72 
> 192.168.192.26 192.168.198.215 192.168.198.205
> bound to 192.168.198.178 -- renewal in 216727 seconds.
> 
> 
> [root@Z2966 ~]# uname -a
> Linux Z2966.tester.com 2.6.18-128.1.10.el5 #1 SMP Thu May 7 10:39:21 EDT 
> 2009 i586 i586 i386 GNU/Linux
> [root@Z2966 ~]# tcpdump -nlvvi eth1 port 67 or port 68
> tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 96 
> bytes
> 10:21:52.499996 IP (tos 0x10, ttl  16, id 0, offset 0, flags [none], 
> proto: UDP (17), length: 328) 0.0.0.0.bootpc > 255.255.255.255.bootps: 
> BOOTP/DHCP, Request from 00:02:b6:36:97:9f, length: 300, xid:0x2f43b119, 
> flags: [none] (0x0000)
>           Client Ethernet Address: 00:02:b6:36:97:9f [|bootp]
> 10:21:52.500840 IP (tos 0x0, ttl 128, id 28479, offset 0, flags [none], 
> proto: UDP (17), length: 348) 192.168.198.70.bootps > 
> 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length: 320, xid:0x2f43b119, 
> flags: [none] (0x0000)
>           Your IP: 192.168.198.178
>           Client Ethernet Address: 00:02:b6:36:97:9f [|bootp]
> 
> 
> 
> IPF rules:
> 
> block in log from any to any
> block in log quick from any to any with short
> pass in quick on lo from any to any
> pass out quick on lo from any to any
> pass out proto tcp from any to any flags S/S keep state
> pass out proto udp from any to any keep state
> pass out proto icmp from any to any keep state
> block in on eth1 from 10.0.0.0/8 to any
> block in on eth1 from 172.16.0.0/12 to any
> block in on eth1 from 192.168.0.0/16 to any
> block in on eth1 from 10.254.1.4/32 to any
> block in on eth1 from 10.254.1.0/24 to any
> pass in quick on eth0 proto tcp from 10.254.1.0/24 port > 1023 to 
> 10.254.1.4/32 port = 22 keep state
> pass in quick on eth0 proto tcp from 10.254.1.0/24 port > 1023 to 
> 10.254.1.4/32 port = 8081 keep state
> pass in quick on eth0 proto icmp from 10.254.1.0/24 to 10.254.1.4/32 
> icmp-type 8 keep state
> pass in quick on eth0 proto udp from 10.254.1.0/24 port >= 1024 to 
> 10.254.1.4/32 port = 161 keep state
> pass in quick on eth0 proto udp from 10.254.1.0/24 port >= 1024 to 
> 10.254.1.4/32 port = 162 keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to any port = 23 
> keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to any port = 21 
> keep state
> pass in quick proto tcp from 10.254.1.0/24 port = 20 to any port > 1023 
> keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to any port = 119 
> keep state
> pass in quick proto udp from 10.254.1.0/24 port = 137 to 10.254.1.255/32 
> port = 137 keep state
> pass in quick proto udp from 10.254.1.0/24 port = 138 to 10.254.1.255/32 
> port = 138 keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to 
> 10.254.1.255/32 port = 139 keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to any port = 80 
> keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to any port = 443 
> keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to 10.254.1.4/32 
> port = 25 keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to 10.254.1.4/32 
> port = 110 keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to 10.254.1.4/32 
> port = 143 keep state
> pass in quick proto tcp from any port > 1023 to 10.254.1.4/32 port = 25 
> keep state
> pass in quick proto udp from 10.254.1.0/24 port > 1023 to 10.254.1.4/32 
> port = 53 keep state
> pass in quick proto udp from 10.254.1.0/24 port = 53 to 10.254.1.4/32 
> port = 53 keep state
> pass in quick proto udp from 10.254.1.0/24 port = 137 to 10.254.1.4/32 
> port = 137 keep state
> pass in quick proto udp from 10.254.1.0/24 port = 138 to 10.254.1.4/32 
> port = 138 keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to 10.254.1.4/32 
> port = 139 keep state
> pass in quick proto tcp from 10.254.1.0/24 port > 1023 to 10.254.1.4/32 
> port = 8080 keep state
> pass in quick proto icmp from any to 10.254.1.4/32 keep state
> pass in quick proto tcp from any port > 1023 to 10.254.1.4/32 port = 80 
> keep state
> pass in quick on eth1 proto tcp from any port > 1023 to 
> 192.168.198.178/32 port = 22 keep state
> pass in quick on eth1 proto tcp from any port > 1023 to 
> 192.168.198.178/32 port = 8081 keep state
> pass in quick on eth1 proto icmp from any to 192.168.198.178/32 
> icmp-type 8 keep state
> pass in quick on eth1 proto udp from any port >= 1024 to 
> 192.168.198.178/32 port = 161 keep state
> pass in quick on eth1 proto udp from any port >= 1024 to 
> 192.168.198.178/32 port = 162 keep state


-- 


+============================================================+
|                                                            |
| Климов Евгений,                                 Jim Klimov |
| технический директор                                   CTO |
| ЗАО "ЦОС и ВТ"                                  JSC COS&HT |
|                                                            |
| +7-903-7705859 (cellular)          mailto:[email protected] |
|                          CC:[email protected],[email protected] |
+============================================================+
| ()  ascii ribbon campaign - against html mail              |
| /\                        - against microsoft attachments  |
+============================================================+