Evil bug in netfilter/kernel 2.4.x?

From: jpiszcz (jpiszcz@lucidpixels.com)
Date: Mon Feb 10 2003 - 17:32:57 EST

"As a secondary note, if you use connection tracking you will not see
any fragmented packets, since they are dealt with before hitting any
chain or table in iptables."


root@p300:/etc/rc.d# iptables -t filter -I INPUT -f -j LOG --log-level 3
--log-prefix "FRAG: "
root@p300:/etc/rc.d# iptables -I INPUT -f -j LOG --log-level 3
--log-prefix "FRAG: "
root@p300:/etc/rc.d# iptables -I INPUT -f -j LOG --log-level 3
--log-prefix "FRAG: "
root@p300:/etc/rc.d# iptables -I INPUT -f -j DROP

I've tried all of these, each one by itself.

However, when I run tcpdump, I can clearly see these are not getting
dropped or logged by the kernel.

I like conn_track for DCC/FTP connections, however, to get logging &
dropping of fragmented packets working properly, I must recompile
without the conn_tracker's?

Wouldn't this be considered as a bug? Someone could be
pounding/scanning you with fragmented packets, and you would never see
it, as many people run the DCC and/or FTP connection trackers!

box1# nmap -sS -P0 -f -p 1-65535 box2.com

17:11:52.659286 box1.com > box2.com: (frag 2729:4@16)
17:11:52.661416 box1.com > box2.com: (frag 986:4@16)
17:11:52.663400 box1.com > box2.com: (frag 61814:4@16)
17:11:52.665398 box1.com > box2.com: (frag 30216:4@16)
17:11:52.667401 box1.com > box2.com: (frag 4100:4@16)
17:11:52.669392 box1.com > box2.com: (frag 61387:4@16)

947 packets received by filter
0 packets dropped by kernel

Is it possible in anyway to log/drop/match fragmented packets with
connection tracking turned on?

Please CC me as I am not on the list.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Sat Feb 15 2003 - 22:00:30 EST