[fw-wiz] Weird FW bridge stuff (Linux)

From: Chris Ditri (chrisd_at_better-investing.org)
Date: 12/09/03

  • Next message: geoffreyh_at_frontlinedefensesystems.com: "[fw-wiz] No connection once the translation rules are applied" 
    To: firewall-wizards@honor.icsalabs.com
Date: Tue, 9 Dec 2003 15:51:36 -0500

    Hello.

    I have setup a linux ethernet bridge/firewall. Everything seemed to be
    working pretty well, until one day I found that my /var/log/messages was
    filled up with 14 gigabytes of this junk:

    Dec 9 15:47:55 kronos nf_hook: hook 4 already set.
    Dec 9 15:47:55 kronos skb: pf=7 (unowned) dev=eth0 len=74
    Dec 9 15:47:55 kronos nf_hook: hook 0 already set.
    Dec 9 15:47:55 kronos skb: pf=2 (unowned) dev=br0 len=69
    Dec 9 15:47:55 kronos PROTO=6 209.202.220.135:25 10.103.232.134:46016 L=69
    S=0x00 I=7745 F=0x4000 T=50
    Dec 9 15:47:55 kronos nf_hook: hook 0 already set.
    Dec 9 15:47:55 kronos skb: pf=7 (unowned) dev=eth0 len=69
    Dec 9 15:47:55 kronos nf_hook: hook 2 already set.
    Dec 9 15:47:55 kronos skb: pf=2 (unowned) dev=eth1 len=69
    Dec 9 15:47:55 kronos PROTO=6 209.202.220.135:25 10.103.232.134:46016 L=69
    S=0x00 I=7745 F=0x4000 T=50
    Dec 9 15:47:55 kronos nf_hook: hook 2 already set.
    Dec 9 15:47:55 kronos skb: pf=7 (unowned) dev=eth1 len=69
    Dec 9 15:47:55 kronos nf_hook: hook 4 already set.
    Dec 9 15:47:55 kronos skb: pf=2 (unowned) dev=eth1 len=69
    Dec 9 15:47:55 kronos PROTO=6 209.202.220.135:25 10.103.232.134:46016 L=69
    S=0x00 I=7745 F=0x4000 T=50
    Dec 9 15:47:55 kronos nf_hook: hook 4 already set.
    Dec 9 15:47:55 kronos skb: pf=7 (unowned) dev=eth1 len=69
    Dec 9 15:47:55 kronos nf_hook: hook 0 already set.
    Dec 9 15:47:55 kronos skb: pf=2 (unowned) dev=br0 len=58
    Dec 9 15:47:55 kronos PROTO=6 10.103.232.134:46016 209.202.220.135:25 L=58
    S=0x00 I=14180 F=0x4000 T=64
    Dec 9 15:47:55 kronos nf_hook: hook 0 already set.
    Dec 9 15:47:55 kronos skb: pf=7 (unowned) dev=eth1 len=58
    Dec 9 15:47:55 kronos nf_hook: hook 2 already set.
    Dec 9 15:47:55 kronos skb: pf=2 (unowned) dev=eth0 len=58
    Dec 9 15:47:55 kronos PROTO=6 10.103.232.134:46016 209.202.220.135:25 L=58
    S=0x00 I=14180 F=0x4000 T=64
    Dec 9 15:47:55 kronos nf_hook: hook 2 already set.
    Dec 9 15:47:55 kronos skb: pf=7 (unowned) dev=eth0 len=58
    Dec 9 15:47:55 kronos nf_hook: hook 4 already set.
    Dec 9 15:47:55 kronos skb: pf=2 (unowned) dev=eth0 len=58
    Dec 9 15:47:55 kronos PROTO=6 10.103.232.134:46016 209.202.220.135:25 L=58
    S=0x00 I=14180 F=0x4000 T=64
    Dec 9 15:47:55 kronos nf_hook: hook 4 already set.
    Dec 9 15:47:55 kronos skb: pf=7 (unowned) dev=eth0 len=58

    I did some poking around, and I heard that this was because of a bug in the
    2.4.19 version of this software (patch for the kernel). So I downloaded and
    compiled the kernel in 2.4.23 -- with the same exact config file. All of a
    sudden none of my IPTABLES rules are not having any influence on traffic!
    Bye-bye fiewall...

    I tried to apply the patch to my 2.4.23 kernel, but it fails. I cannot find
    this version of a bridge patch for 2.4.23 anywhere. I have read that people
    have gotten this sort of thing working with kernel 2.4.20 and up -- but no
    reference as to what they had to do to get it working right.

    What can I do?

    Thanks!

    Chris

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: geoffreyh_at_frontlinedefensesystems.com: "[fw-wiz] No connection once the translation rules are applied"

    Relevant Pages

    • FW bridge problems (Linux)
      ... I have setup a linux ethernet bridge/firewall. ... Dec 9 15:47:55 kronos nf_hook: hook 0 already set. ... compiled the kernel in 2.4.23 -- with the same exact config file. ...
      (Security-Basics)
    • Re: [PATCH 2 of 4] Introduce i386 fibril scheduling
      ... Also, when returning, check and clear the thread-blocked hook. ... - The hook copies the necessary state to a new kernel ... notices that its scheduler hook is no longer set. ... use a different scheduler hook function) and set up the state machine ...
      (Linux-Kernel)
    • Re: kernel 2.6.8 pwc patches and counterpatches
      ... By providing a hook, there is a chance to insert an other ... This hook has been there since the beginning of PWC in the ... kernel, so I don't consider it a 'change'. ... forgetting what open source is about, ...
      (Linux-Kernel)
    • App verifier, HOOK, shim and how wince works
      ... What I wanted to do first was to hook system calls, I have managed to hooks some functions like CreateFile, RegCreateKeyE, ... ... Interesting part is on one hand 0xFFFFC800 because this memory address corresponds to the address where the kernel is loaded on ARM platform and on the other hand 0xF000AFDC because this corresponds to an exception and the kernel knows it corresponds to a system call. ... For instance CreateFile is implemented inside filesys.exe but how can I hook syscalls when pServer is NULL ...
      (microsoft.public.windowsce.embedded)
    • Re: Process creation interception
      ... The best method for preventing process-creation is to hook ... either the ZwCreateProcess API in kernel, ... You really need to be doing this type of "system-wide" stuff in the kernel.. ... > I am developing some kind of a watch dog, this watch dog should intercept ...
      (microsoft.public.win32.programmer.kernel)