Re: Ambiguities in TCP/IP - firewall bypassing

From: Florian Weimer (Weimer@CERT.Uni-Stuttgart.DE)
Date: 10/21/02 

To: Aaron Hopkins <lists@die.net>
From: Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>
Date: Mon, 21 Oct 2002 11:50:42 +0200

Aaron Hopkins <lists@die.net> writes:

> On Sat, 19 Oct 2002, Florian Weimer wrote:
>
>> "established" in Cisco parlance does not mean "SYN unset", but "ACK or RST
>> set". This means that the impact for non-Linux hosts (which do not react
>> to SYN-RST packets according to Paul's survey) is less severe if your
>> filters run IOS.
>
> This is true for IOS up through 11.3. The 12.0, 12.1, and 12.2
> documentation claims:

> established: (Optional) For the TCP protocol only: Indicates an
> established connection. A match occurs if the TCP datagram
> has the ACK, FIN, PSH, RST, SYN or URG control bits set.
> The nonmatching case is that of the initial TCP datagram to
> form a connection."

This documentation is quite misleading. Our experiments with a 12.1
version suggests that RST and/or ACK bits cause the packet to pass.

> If the documentation is correct, then you can fool IOS 12.0+ "permit tcp any
> any established" at the top of an access list into letting you make
> connections to any port on at least Linux 2.4.19, Solaris 5.8, FreeBSD 4.5,
> and Windows NT 4.0, as reported by Paul Starzetz in the post starting this
> thread.

The SYN,FIN combination is filtered (it's permitted by the RFC if you
read it carefully, I think, and some systems can cope with it).

> Thats not necessarily true. At least with current IOS (12.2, perhaps
> earlier), you can specify "permit tcp any any ack" instead of "permit tcp
> any any established" to work around this bug entirely and retain almost all
> functionality.

Interesting, thanks. It's not documented for 12.1. The CLI accepts
it, though. I'll check if it's properly supported.

This approach is much more general than reflexive access lists (which
can break long-lasting interactive sessions because of the timeouts
involved). 

-- 
Florian Weimer 	                  Weimer@CERT.Uni-Stuttgart.DE
University of Stuttgart           http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT                          fax +49-711-685-5898

Relevant Pages

  • Re: Kernel streaming
    ... > The architecture reflects that of Direct Show with Filters and Graphs. ... > application space but control real filters sitting in kernal space. ... > inclined to use a stronger term...). ... > There is a smidgeon in the Direct Show documentation, ...
    (microsoft.public.win32.programmer.directx.audio)
  • Pocket MSN Help/Documentation
    ... Does anyone know of a source for more extensive help or documentation on ... Pocket MSN then what is installed on the device? ... filters, but how do you set the filters? ... Prev by Date: ...
    (microsoft.public.pocketpc)
  • Re: mail folders
    ... Todd Slater also told you, that he's got more than 20 filters. ... it seems as if the documentation in the FAQ is out of date. ...
    (Ubuntu)
  • Re: procmail question
    ... > Here is a bit harder question:). ... > So I want a rule which filters all mails, if ... I'm 99.9% sure you can't filter on bcc: ... pointers to the documentation (and you did read the documentation, ...
    (Debian-User)
  • Re: error C2653: ios : is not a class or namespace name
    ... from the documentation it seems that ios is legacy. ...
    (microsoft.public.dotnet.languages.vc)
Loading