Skip to contentSkip to conversation

: fix ipt_REJECT broken UDP crc firewall spotting (phrack 60)

PATCH In review Patrick McHardy 2 participants 2 messages Jan 5, 2003 – Jan 6, 2003

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Patrick McHardy

author
#0 lore raw

PATCH 1/1 : fix ipt_REJECT broken UDP crc firewall spotting (phrack 60)

Hi.

Sorry if this mail arrives twice, mozilla crashed while sending and it seems it did not make it out before. ipt_REJECT sends unreachables in response to UDP packets with invalid checksums, thereby exposing the existance of a firewall (as described in phrack #60, "broken crc firewall spotting" (or something like this), www.phrack.com). to verify please try this:

# send udp with correct checksum
hping -2 host -p 20000
# send udp with invalid checksum
hping -2 host -p 20000 -b

now insert a rule to reject those packets on host or somewhere between you and host and try it again. The patch makes ipt_REJECT verify UDP checksums if set.

Regards,
Patrick

net/ipv4/netfilter/ipt_REJECT.c +16 -0
diff -urN linux-2.4.21-pre2-clean/net/ipv4/netfilter/ipt_REJECT.c linux-2.4.21-pre2/net/ipv4/netfilter/ipt_REJECT.c
@@ -6,6 +6,8 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/icmp.h>
 #include <net/icmp.h>
 #include <net/ip.h>
 #include <net/tcp.h>

@@ -157,6 +159,7 @@
 static void send_unreach(struct sk_buff *skb_in, int code)
 {
 	struct iphdr *iph;
+	struct udphdr *udph;
 	struct icmphdr *icmph;
 	struct sk_buff *nskb;
 	u32 saddr;

@@ -186,6 +189,19 @@
 	if (iph->frag_off&htons(IP_OFFSET))
 		return;
 
+	/* if UDP checksum is set, verify it's correct */
+	if (iph->protocol == IPPROTO_UDP
+	    && skb_in->tail-(u8*)iph >= sizeof(struct udphdr)) {
+		int datalen = skb_in->len - (iph->ihl<<2);
+		udph = (struct udphdr *)((char *)iph + (iph->ihl<<2));
+		if (udph->check
+		    && csum_tcpudp_magic(iph->saddr, iph->daddr,
+		                         datalen, IPPROTO_UDP,
+		                         csum_partial((char *)udph, datalen,
+		                                      0)) != 0)
+			return;
+	}
+		    
 	/* If we send an ICMP error to an ICMP error a mess would result.. */
 	if (iph->protocol == IPPROTO_ICMP
 	    && skb_in->tail-(u8*)iph >= sizeof(struct icmphdr)) {

Bin�rdateien linux-2.4.21-pre2-clean/net/ipv4/netfilter/.ipt_REJECT.c.swp and linux-2.4.21-pre2/net/ipv4/netfilter/.ipt_REJECT.c.swp sind verschieden.

#1 lore raw
Quoted 6 lines · Patrick McHardy

Hi.

ipt_REJECT sends unreachables in response to UDP packets with invalid checksums, thereby exposing the
existance of a firewall (as described in phrack #60, "broken crc firewall spotting" (or something like this), www.phrack.com).

Thanks for fixing this issue. I will put your patch into the 'pending' queue of patch-o-matic.

Quoted 2 lines

Regards,
Patrick

Signature · 4 lines
- Harald Welte / [email protected]               http://www.gnumonks.org/
============================================================================
"If this were a dictatorship, it'd be a heck of a lot easier, just so long
 as I'm the dictator."  --  George W. Bush Dec 18, 2000