Debug kernel network hook chain or why has Check Point Firewall module problems with IPv6

Hi,

I found a for me strange issue and need help to dig a little bit into because I'm running out of knowledge.

Pls. don't comment the use of commercial firewalls on Linux ;-)

Running a Check Point Firewall (NG FP-2) on Linux (RHL kernel 2.4.9-31, OpenSSH 2.9 and 3.1) this loads its big firewall module into the kernel.

First question:
how can I check, which kernel network hooks it use? Are there any tools available?

Now further on...

"No problem" scenario:
Linux is IPv4-only, openssh bound to 0.0.0.0, incoming SSH traffic is accepted and CP state table is updated

"Problematic" scenario:
Linux has ipv6 module loaded, openssh bound to ::, now following happen:

incoming SSH traffic (still IPv4) is accepted, CP updates the initial connection timer but never update its state table to state "established". The initial timer is still updated after each keystroke, but if timeout occurs (default 60s), the connection will break.

Looks like CP never sees (or recognizes) packets leaving the firewalled host from a dual-stack application.

Second question:
Can I trace such issues? Is there a toolset available which shows me which way a packet run in network kernel?

BTW: incoming SSH traffic via IPv6 is completly unrecognized and therefore quietly accepted. Looks like CP never sees or recognize incoming IPv6 packets at all - same issue, if on a IPv4-netfiltererd box the IPv6-netfilter was forgotten...

TIA,
Peter

Linux has no "generic" firewall hooks, only protocol specific ones. Checkpoint is probably using the v4 specific ones only.
Other protocols can be received (by registering a protocol to ETH_P_ALL via SOCK_PACKET or in the kernel), but not stolen from protocol handlers.

2.2 had no working firewall chains for IPv6, 2.4 has a v6 netfilter interface.

BTW the CheckPoint module seems to leak routes too at least on 2.2, there are regular reports of that.

Sounds like a serious CheckPoint bug.

-Andi

Hi Andi,

thanks for fast answering, need only a short explanation now:

Is such IPv4 hook not seeing packets leaving a dual-stack application like openssh? Is there any scheme (the way such packet takes) available for visualisation.

TIA,
Peter

The v4 hook only sees packets that are sent as v4. The v6 hook only v6. It has nothing to do with the application using v4-mapped-on-v6 sockets or not.

-Andi

Thanks for reply. Is there any tool available which can display which application has registered which network hooks?

TIA,
Peter

Only a kernel debugger (gdb vmlinux /proc/kcore)

-Andi

Can you explain what's happen? Perhaps caused by their implementation of NAT.

Peter

I have no idea what happens exactly, except that there were several reports to this list of users who ran into problems with an overflowing routing cache. All they had in common was that they run CheckPoint on 2.2. There were no other such reports from non BreakPoint users. I may be fixed in the 2.4 version of their module.

-Andi