Skip to contentSkip to conversation

ip_conntrack_ftp.c

PATCH New Andre Marais 1 participant 1 message Nov 11, 2002

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Andre Marais

author
#0 lore raw

PATCH 1/1 ip_conntrack_ftp.c

Netfilter team,

CERT has published a vulnerability related to poor ftp state tracking where arbitrary connections could be established to machines behind a firewall with FTP connection tracking enabled (CERT VU#328867).

Although the netfilter code as it stands now does not allow this to happen with sane FTP servers, I fear that a poor implementation or completely broken (or hacked) FTP server could render the firewall useless.

I have generated a patch against linux 2.4.18 that does bi-directional state tracking (based on a patch for 2.4.0 by Jozsef Kadlecsik) and does more explicit checks.

Feedback would be much appreciated, but please mail me directly since I'm not on the mailing list.

Regards,
Andre

Signature · 39 lines
Andre Marais
SecureWorx (Pty) Ltd.
Development Engineer
+27-82-645-5889
www.secureworx.com

Reading, after a certain age, diverts the mind too much from its 
creative pursuits. Any man who read too much and uses his own brain 
too little falls into lazy habits of thinking.
 - Albert Einstein.

-----------------------------------------------------------------------
LEGAL DISCLAIMER:
The views or representations contained in this message, whether express
or implied, are those of the sender only, unless that sender expressly
states them to be the view or representations of an entity or person,
who shall be named by the sender and the sender shall state to
represent. No liability shall otherwise attach to any other entity or
person.
-----------------------------------------------------------------------

Established in 1995, SECUREWORX South Africa (Pty) Ltd
(www.SECUREWORX.com), SECUREWORX designs, develops, manufactures and
sells Internet security infrastructure solutions that secure information
assets and enable privacy and security for e-Business and m-Business
communications.
 
SECUREWORX is a pioneer in the creation of plug-and-protect all-in-one
Gateway Security solutions for customers in small offices/home offices
(SOHO's), Small Medium Enterprise (SME), Remote Office Branch Office
(ROBO), SME headquarters', telecommuters and mobile workers, Data
Centres, Education and Government markets - particularly those using
"always-on" broadband internet connections which includes Satellite,
Digital Subscriber Line (DSL), and cable modem users (collectively, our
target market).  

SECUREWORX's Vision is to be an internationally acclaimed developer of
Threat Management Security Solutions that provide "Defence-in-depth" and
"Security Piece-of-Mind"
include/linux/netfilter_ipv4/ip_conntrack_ftp.h +41 -8
diff -Naur --exclude '*.orig' --exclude '*.swp' --exclude '*.rej' --exclude .config --exclude .depend --exclude .depend --exclude .config --exclude .hdepend --exclude .version --exclude System.map --exclude '*.o' --exclude '*.flags' --exclude compile.h --exclude autoconf.h linux-original/include/linux/netfilter_ipv4/ip_conntrack_ftp.h linux/include/linux/netfilter_ipv4/ip_conntrack_ftp.h
@@ -1,3 +1,22 @@
+/* Date of FTP PASV patch : 2002-11-11
+ * Credits :
+ *   o SecureWorx [www.secureworx.com]
+ *     Credits go to Andre Marais ([email protected])
+ *     as primary contributer.
+ *   o Jozsef Kadlecsik for the initial base-code patch for 2.4.0. 
+ *
+ * Disclaimer :
+ *
+ *   SECUREWORX DISCLAIMS ALL WARRANTIES WITH REGARD TO
+ *   THIS SOFTWARE/PATCHES, INCLUDING ALL IMPLIED WARRANTIES OF 
+ *   MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL SECUREWORX 
+ *   BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES 
+ *   OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR 
+ *   PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER 
+ *   TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE 
+ *   OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
 #ifndef _IP_CONNTRACK_FTP_H
 #define _IP_CONNTRACK_FTP_H
 /* FTP tracking. */

@@ -11,16 +30,22 @@
 /* Protects ftp part of conntracks */
 DECLARE_LOCK_EXTERN(ip_ftp_lock);
 
-enum ip_ct_ftp_type
+/* enum ip_ct_ftp_type */
+enum ip_ct_ftp_state
 {
+	/* New double states to see who's sending
+	   possible garbage around... 
+	   One for PORT command and one for PASV */
+	FTP_STATE_INVALID,
+
 	/* PORT command from client */
-	IP_CT_FTP_PORT,
+	FTP_STATE_PORT_REQUEST,
+	/* PORT response from client */
+	FTP_STATE_PORT_RESPONSE,
+	/* PASV command from client */
+	FTP_STATE_PASV_REQUEST,
 	/* PASV response from server */
-	IP_CT_FTP_PASV,
-	/* EPRT command from client */
-	IP_CT_FTP_EPRT,
-	/* EPSV response from server */
-	IP_CT_FTP_EPSV,
+	FTP_STATE_PASV_RESPONSE,
 };
 
 /* We record seq number and length of ftp ip/port text here: all in

@@ -32,7 +57,15 @@
 	u_int32_t seq;
 	/* 0 means not found yet */
 	u_int32_t len;
-	enum ip_ct_ftp_type ftptype;
+	/* enum ip_ct_ftp_type ftptype; */
+
+	/* Direction of packet, which must be mangled by NAT */
+	enum ip_conntrack_dir dir;
+	/* Expected FTP state */
+	enum ip_ct_ftp_state expect;
+	/* Current FTP state */
+	enum ip_ct_ftp_state cur_state;
+
 	/* Port that was to be used */
 	u_int16_t port;
 	/* Next valid seq position for cmd matching after newline */
net/ipv4/netfilter/ip_conntrack_ftp.c +192 -76

386 lines not on this page · raw message

net/ipv4/netfilter/ip_nat_ftp.c +36 -10

93 lines not on this page · raw message