From owner-freebsd-pf@FreeBSD.ORG Wed Aug 2 16:02:55 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E6D8616A4E0; Wed, 2 Aug 2006 16:02:55 +0000 (UTC) (envelope-from max@love2party.net) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.187]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1AEF443D4C; Wed, 2 Aug 2006 16:02:55 +0000 (GMT) (envelope-from max@love2party.net) Received: from [88.64.177.237] (helo=amd64.laiers.local) by mrelayeu.kundenserver.de (node=mrelayeu3) with ESMTP (Nemesis), id 0MKxQS-1G8JBH1GJr-0000if; Wed, 02 Aug 2006 18:02:48 +0200 From: Max Laier Organization: FreeBSD To: Frank Steinborn Date: Wed, 2 Aug 2006 18:02:38 +0200 User-Agent: KMail/1.9.3 References: <20060801142925.54F5CB828@shodan.nognu.de> <200608021601.49038.max@love2party.net> <20060802142129.D0BBDB81E@shodan.nognu.de> In-Reply-To: <20060802142129.D0BBDB81E@shodan.nognu.de> X-Face: ,,8R(x[kmU]tKN@>gtH1yQE4aslGdu+2]; R]*pL,U>^H?)gW@49@wdJ`H<=?utf-8?q?=25=7D*=5FBD=0A=09U=5For=3D=5CmOZf764=26nYj=3DJYbR1PW0ud?=>|!~,,CPC.1-D$FG@0h3#'5"k{V]a~.<=?utf-8?q?mZ=7D44=23Se=7Em=0A=09Fe=7E=5C=5DX5B=5D=5Fxj?=(ykz9QKMw_l0C2AQ]}Ym8)fU MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart1516151.JIObnv37Nv"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200608021802.45589.max@love2party.net> X-Provags-ID: kundenserver.de abuse@kundenserver.de login:61c499deaeeba3ba5be80f48ecc83056 Cc: gnn@freebsd.org, freebsd-pf@freebsd.org Subject: Re: I'm getting sick - Problems filtering IPv6. X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Aug 2006 16:02:56 -0000 --nextPart1516151.JIObnv37Nv Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline [please do not cut the audit trail from your replys - it really helps to ha= ve=20 all information in one email] Short recap for everybody: Using pf stateful rules for inet6 fails for=20 connections originating from the firewall itself to a service running on th= e=20 same box. Culprit seems to be interface selection in inet6 (switching=20 between the interface that has the address configured and lo0). See below. On Wednesday 02 August 2006 16:21, Frank Steinborn wrote: > Max Laier wrote: > > > Hello Max, > > > > > > a state is created, yes: > > > > > > self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[62810] > > > SYN_SENT:ESTABLISHED > > > [342525613 + 65536](+2469478632) wscale 1 [3355548528 + > > > 65537](+82545723) wscale 1 > > > [1845438366 + 4880](+1776883750) [3423429433 + 65535](+3331864375) > > > age 00:37:53, expires in 00:00:59, 2204:15980 pkts, 107106:2269450 > > > bytes > > > age 01:22:57, expires in 00:01:00, 5472:42944 pkts, 324485:6199453 > > > bytes > > > age 02:00:22, expires in 00:00:59, 11249:53620 pkts, 967458:7637333 > > > bytes > > > > > > > > > Strange thing :-( > > > > Indeed, and far from what I expected to see. These states exist for a > > long time and have seen lots of packets in both directions. Are you su= re > > you copied the right counters for that state? Can you please enable > > extended logging with "pfctl -x misc" and report any related messages > > from console. Also, please recheck pfctl -vss for the right state > > counters. I do get this right, the "telnet 2001:1638:17ad::3 53" stall= ed > > right away? > > You are correct, I probably tried to many telnets so that states are > left. I did it again, and here is the state from the telnet: > > self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[59655] > SYN_SENT:ESTABLISHED > [2728554970 + 65536](+2360520929) wscale 1 [1947983223 + > 65537](+3290820275) wscale 1 > age 00:00:02, expires in 00:00:28, 1:1 pkts, 84:84 bytes, rule 45 > > There is nothing logged on the console due to pfctl -x misc, so i > tried pfctl -x loud. However, the only thing i see are some > > "fingerprinted 84.191.87.127:64944 8576:118:0:48:403 (4) > (TS=3D,M=3D536,W=3D0)" (IP's vary, of course, can't find v6 however) > > and > > "osfp no match against 3400000". > > But i guess that's not important here. > > And yes, you got it right - if I "telnet 2001:1638:17ad::3 53" it just > stalls and times out after some time (even when i try block-policy > return). But only on the box itself where pf and named is running, > other boxes can access it fine. Using this simple test ruleset, I was able to spot the problem: pass quick on lo0 all pass quick on bge0 inet all block drop log all pass in log-all on bge0 inet6 proto tcp from any to 3000::1 port =3D ssh \ flags S/SA keep state tcpdump on pflog0 shows that the initial SYN is coming from bge0. The repl= y=20 then comes via lo0 and matches the state (if state-policy is floating). Th= e=20 third packet (again via bge0) then does no longer match the state - however: 17:51:17.594100 rule 3/0(match): pass in on bge0: 3000::1.54335 > 3000::1.2= 2:=20 S 3551126931:3551126931(0) win 65535 17:51:17.594150 rule 3/0(match): pass out on lo0: 3000::1.22 > 3000::1.5433= 5:=20 S 3700289867:3700289867(0) ack 3551126932 win 65535 17:51:17.594157 rule 2/0(match): block in on bge0: 3000::1.22 > 3000::1.543= 35:=20 S 3700289867:3700289867(0) ack 3551126932 win 65535 Can somebody with a recent OpenBSD box please check the behavior of inet6=20 routing/interface selection there and report? As for a fix, I suspect that fixing the inet6 routing/interface selection w= ill=20 be far from trivial (and I have to check with the RFCs to see if we may=20 change it at all). Something is certainly broken in inet6-land as *none* o= f=20 these packets show up in any bpf - not on lo0 and neither on bge0. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart1516151.JIObnv37Nv Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (FreeBSD) iD8DBQBE0MylXyyEoT62BG0RAjxZAJ9DL9xMxin+RkKiqOCGxS9bi5E+WgCeJcpc Ln1+Y/4vPvtnvY0ghaKjjb8= =TF9U -----END PGP SIGNATURE----- --nextPart1516151.JIObnv37Nv--