Does now IPFilter support reassemble IP fragments?

"Xiaohong Liu" <[email protected]> Thu, 18 Nov 2010 02:26:30 -0600
Newsgroups gmane.comp.security.firewalls.ipfilter
Message-ID <18660_1290068985_4CE4E3F8_18660_2147_1_0162EBEA27F7CB4D9DB0DBA1D6CF93A902D37C39@zrc2hxm1.corp.nortel.com>
This is a multi-part message in MIME format.

------_=_NextPart_001_01CB86FA.4DF8EA3D
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_002_01CB86FA.4DF8EA3D"


------_=_NextPart_002_01CB86FA.4DF8EA3D
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi, all

I use IP filter v4.1.9(592) on Solaris 10 U8.=20

During testing, I observe that IPFilter will block the fragmented
packets out of order when the server doesn't receive the first segment
before any of others.=20

Snoop packets are given as an example as the following: Packet 1 & 3 are
dropped. Packet 2 & 4 are passed, but waiting for the later fragment. As
a result of the packets dropping, ICMP of reassembly time exceeded
packets are sent out finally.

  1   0.00000 47.154.158.103 -> zcydsf874ha  UDP IP fragment ID=3D10796
Offset=3D1480 MF=3D0 TOS=3D0x0 TTL=3D64
  2   0.00025 47.154.158.103 -> zcydsf874ha  UDP IP fragment ID=3D10796
Offset=3D0    MF=3D1 TOS=3D0x0 TTL=3D64
  3  10.00706 47.154.158.103 -> zcydsf874ha  UDP IP fragment ID=3D10797
Offset=3D1480 MF=3D0 TOS=3D0x0 TTL=3D64
  4   0.00010 47.154.158.103 -> zcydsf874ha  UDP IP fragment ID=3D10797
Offset=3D0    MF=3D1 TOS=3D0x0 TTL=3D64
  5   6.89527  zcydsf874ha -> 47.154.158.103 ICMP Time exceeded (in
reassembly)
  6   0.00010  zcydsf874ha -> 47.154.158.103 ICMP Time exceeded (in
reassembly)
  7   0.00008  zcydsf874ha -> 47.154.158.103 ICMP Time exceeded (in
reassembly)


I come to consult if IPFilter later version supports automatically
reassemble IP fragments, or any solution can help me to resolve such
problem?

thank you very much!

P.S.=20

current IP filter version:

bash-3.00# ipf -V
ipf: IP Filter: v4.1.9 (592)
Kernel: IP Filter: v4.1.9
Running: yes
Log Flags: 0 =3D none set
Default: pass all, Logging: available
Active list: 1
Feature mask: 0x107


Best regards=20

Xiaohong Liu (Susan)=20
Email: [email protected]=20
Tele:  +65 6510 7931/ESN 542 7931=20

"The author works for Telfonaktiebolaget L M Ericsson ("Ericsson"), who
is solely responsible for this email and its contents. All inquiries
regarding this email should be addressed to Ericsson. Nortel has
provided the use of the nortel.com domain to Ericsson in connection with
this email solely for the purpose of connectivity and Nortel Networks
has no liability for the email or its contents. The web site for
Ericsson is www.ericsson.com <http://www.ericsson.com/> ."


=20

------_=_NextPart_002_01CB86FA.4DF8EA3D
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE id=3DridTitle>Blank</TITLE>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<STYLE><!-- body  { font-family: Arial, Helvetica; font-size: 10pt; =
color: #000000; margin-top: 25px; margin-left: 25px; } P.msoNormal, =
LI.msoNormal  { font-family: Helvetica, "Times New Roman"; font-size: =
10pt; margin-top: 0px; margin-left: 0px; color: "#ffffcc"; } --></STYLE>

<META content=3D"MSHTML 6.00.2900.6036" name=3DGENERATOR></HEAD>
<BODY id=3DridBody background=3Dcid:092541408@18112010-17F8>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>Hi, =
all</FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>I use IP =
filter=20
v4.1.9(592) on Solaris 10 U8. </FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>During =
testing, I observe=20
that IPFilter will block the fragmented packets out of order when the =
server=20
doesn't receive the first segment before any of others. =
</FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>Snoop packets =
are given as=20
an example as the following: Packet 1 &amp; 3 are dropped. Packet 2 =
&amp; 4 are=20
passed, but waiting for the later fragment. As a result of the packets =
dropping,=20
ICMP&nbsp;of reassembly time exceeded packets are sent out=20
finally.</FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>&nbsp; =
1&nbsp;&nbsp;=20
0.00000 47.154.158.103 -&gt; zcydsf874ha&nbsp; UDP IP fragment =
ID=3D10796=20
Offset=3D1480 MF=3D0 TOS=3D0x0 TTL=3D64<BR>&nbsp; 2&nbsp;&nbsp; 0.00025 =
47.154.158.103=20
-&gt; zcydsf874ha&nbsp; UDP IP fragment ID=3D10796 =
Offset=3D0&nbsp;&nbsp;&nbsp; MF=3D1=20
TOS=3D0x0 TTL=3D64<BR>&nbsp; 3&nbsp; 10.00706 47.154.158.103 -&gt; =
zcydsf874ha&nbsp;=20
UDP IP fragment ID=3D10797 Offset=3D1480 MF=3D0 TOS=3D0x0 =
TTL=3D64<BR>&nbsp; 4&nbsp;&nbsp;=20
0.00010 47.154.158.103 -&gt; zcydsf874ha&nbsp; UDP IP fragment =
ID=3D10797=20
Offset=3D0&nbsp;&nbsp;&nbsp; MF=3D1 TOS=3D0x0 TTL=3D64<BR>&nbsp; =
5&nbsp;&nbsp;=20
6.89527&nbsp; zcydsf874ha -&gt; 47.154.158.103 ICMP Time exceeded (in=20
reassembly)<BR>&nbsp; 6&nbsp;&nbsp; 0.00010&nbsp; zcydsf874ha -&gt;=20
47.154.158.103 ICMP Time exceeded (in reassembly)<BR>&nbsp; =
7&nbsp;&nbsp;=20
0.00008&nbsp; zcydsf874ha -&gt; 47.154.158.103 ICMP Time exceeded (in=20
reassembly)<BR></FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010></SPAN><SPAN =
class=3D092541408-18112010><FONT=20
color=3D#0000ff>I come to consult if IPFilter later version supports =
automatically=20
reassemble IP fragments, or any solution can help me to resolve such=20
problem?</FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>thank you very =

much!</FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>P.S. =
</FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>current IP =
filter=20
version:</FONT></SPAN></P>
<P><SPAN class=3D092541408-18112010><FONT color=3D#0000ff>bash-3.00# ipf =
-V<BR>ipf:=20
IP Filter: v4.1.9 (592)<BR>Kernel: IP Filter: v4.1.9<BR>Running: =
yes<BR>Log=20
Flags: 0 =3D none set<BR>Default: pass all, Logging: available<BR>Active =
list:=20
1<BR>Feature mask: 0x107<BR></FONT></SPAN></P><!-- Converted from =
text/rtf format -->
<P align=3Dleft><STRONG><FONT color=3D#008000><FONT face=3D"Arial =
Unicode MS"><SPAN=20
lang=3Den-us><EM>Best regards</EM></SPAN> </FONT></FONT></STRONG></P>
<P><FONT color=3D#008000><STRONG><FONT face=3D"Arial Unicode MS"><FONT=20
color=3D#800080><SPAN lang=3Den-us>Xiaohong Liu</SPAN>&nbsp;(Susan) =
<BR></FONT><SPAN=20
lang=3Den-us>Email: <U>[email protected]</U></SPAN> <BR><SPAN=20
lang=3Den-us>Tele:&nbsp;&nbsp;+65 6510 7931/ESN 542 7931</SPAN></FONT>=20
</STRONG></FONT></P>
<P><SPAN lang=3DEN-CA=20
style=3D"FONT-SIZE: 9pt; COLOR: blue; FONT-FAMILY: Arial; =
mso-bidi-font-family: Arial"><EM>&#8220;The=20
author works for Telfonaktiebolaget L M Ericsson =
(&#8220;Ericsson&#8221;), who is solely=20
responsible for this email and its contents. All inquiries regarding =
this email=20
should be addressed to Ericsson. Nortel has provided the use of the =
nortel.com=20
domain to Ericsson in connection with this email solely for the purpose =
of=20
connectivity and Nortel Networks has no liability for the email or its =
contents.=20
The web site for Ericsson is <B><A title=3Dhttp://www.ericsson.com/=20
href=3D"http://www.ericsson.com/">www.ericsson.com</A></B>.&#8221;<?xml:n=
amespace prefix=20
=3D o ns =3D "urn:schemas-microsoft-com:office:office"=20
/><o:p></o:p></EM></SPAN></P><BR>
<DIV>&nbsp;</DIV></BODY></HTML>

------_=_NextPart_002_01CB86FA.4DF8EA3D--

------_=_NextPart_001_01CB86FA.4DF8EA3D
Content-Type: image/gif;
	name="Blank Bkgrd.gif"
Content-Transfer-Encoding: base64
Content-ID: <092541408@18112010-17F8>
Content-Description: Blank Bkgrd.gif
Content-Location: Blank%20Bkgrd.gif

R0lGODlhLQAtAID/AP////f39ywAAAAALQAtAEACcAxup8vtvxKQsFon6d02898pGkgiYoCm6sq2
7iqWcmzOsmeXeA7uPJd5CYdD2g9oPF58ygqz+XhCG9JpJGmlYrPXGlfr/Yo/VW45e7amp2tou/lW
xo/zX513z+Vt+1n/tiX2pxP4NUhy2FM4xtjIUQAAOw==

------_=_NextPart_001_01CB86FA.4DF8EA3D--