Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Lost CONNTRACK with hardened-sources-4.7.x [SOLVED]
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
hanj
Veteran
Veteran


Joined: 19 Aug 2003
Posts: 1400

PostPosted: Wed Nov 09, 2016 5:20 pm    Post subject: Lost CONNTRACK with hardened-sources-4.7.x [SOLVED] Reply with quote

Upgrading the kernel this morning to 4.7.10-hardened, I noticed that I was no longer able to FTP to passive FTP servers. I immediately thought it was related to CONNTRACK options in netfilter, but they're all enabled and built into the kernel (no modules). I rolled back to 4.7.6.. same thing. When I rolled back to 4.4.8 I was able to FTP again.

Code:
cat config-4.4.8-hardened-r1  | grep CONN | grep -v \#
CONFIG_NF_CONNTRACK=y
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_PROCFS=y
CONFIG_NF_CONNTRACK_EVENTS=y
CONFIG_NF_CONNTRACK_FTP=y
CONFIG_NF_CONNTRACK_IRC=y
CONFIG_NF_CONNTRACK_TFTP=y
CONFIG_NETFILTER_XT_CONNMARK=y
CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
CONFIG_NF_CONNTRACK_IPV4=y
CONFIG_NF_CONNTRACK_PROC_COMPAT=y


Code:
cat config-4.7.6-hardened  | grep CONN | grep -v \#
CONFIG_NF_CONNTRACK=y
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_PROCFS=y
CONFIG_NF_CONNTRACK_EVENTS=y
CONFIG_NF_CONNTRACK_FTP=y
CONFIG_NF_CONNTRACK_IRC=y
CONFIG_NF_CONNTRACK_TFTP=y
CONFIG_NETFILTER_XT_CONNMARK=y
CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
CONFIG_NF_CONNTRACK_IPV4=y
CONFIG_NF_CONNTRACK_PROC_COMPAT=y


I'm wondering if something to do with established, related logic.. but I have no other network related issues. The only thing that appears to be affected is FTP connections. I re-emerged iptables with different versions.. just in case.

Any ideas?

Thanks!
hanji
_________________
Server Admin Blog - Uno-Code.com | Gentoo Hosting at Rackspace!


Last edited by hanj on Thu Dec 01, 2016 4:05 pm; edited 3 times in total
Back to top
View user's profile Send private message
hanj
Veteran
Veteran


Joined: 19 Aug 2003
Posts: 1400

PostPosted: Wed Nov 09, 2016 7:54 pm    Post subject: Reply with quote

I removed the following that were set by default...

Code:
CONFIG_NETFILTER_XT_NAT is not set
CONFIG_NETFILTER_XT_TARGET_NETMAP is not set
CONFIG_NF_NAT_MASQUERADE_IPV4 is not set
CONFIG_IP_NF_NAT is not set


Not sure why that was causing problem.. but noticed they weren't set in 4.4 and set in 4.7

Thanks!
hanji
_________________
Server Admin Blog - Uno-Code.com | Gentoo Hosting at Rackspace!
Back to top
View user's profile Send private message
hanj
Veteran
Veteran


Joined: 19 Aug 2003
Posts: 1400

PostPosted: Thu Nov 10, 2016 5:22 am    Post subject: Reply with quote

Correction.. my 'fix' broke NAT and iptables didn't start.. so it appeared to 'work'. Restoring NAT, and I'm back to the same problem.
_________________
Server Admin Blog - Uno-Code.com | Gentoo Hosting at Rackspace!
Back to top
View user's profile Send private message
cord
Guru
Guru


Joined: 28 Apr 2007
Posts: 303

PostPosted: Sun Nov 13, 2016 8:15 am    Post subject: Reply with quote

Try nftables (why nftables? - read here).
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3691
Location: Hamburg

PostPosted: Sun Nov 13, 2016 11:42 am    Post subject: Re: Lost CONNTRACK with hardened-sources-4.7.x Reply with quote

hanj wrote:
Upgrading the kernel this morning to 4.7.10-hardened, I noticed that I was no longer able to FTP to passive FTP servers.
Do you have an example link of a public passive FTP server ? I do run 4.7.10 - so I could test from here too.
Back to top
View user's profile Send private message
hanj
Veteran
Veteran


Joined: 19 Aug 2003
Posts: 1400

PostPosted: Wed Nov 30, 2016 5:21 pm    Post subject: Reply with quote

I added some more information on this bug. I tried with 4.8.10 and problem persists. I saw references to PAX/GRSEC in change log for 4.8.10 so I thought we were on to something. I disabled GRSEC, and I'm still experiencing the same issue..

https://bugs.gentoo.org/show_bug.cgi?id=599354

Thanks!
hanji
_________________
Server Admin Blog - Uno-Code.com | Gentoo Hosting at Rackspace!
Back to top
View user's profile Send private message
hanj
Veteran
Veteran


Joined: 19 Aug 2003
Posts: 1400

PostPosted: Thu Dec 01, 2016 4:05 pm    Post subject: Reply with quote

I got it to work. I did add USE=conntrack to iptables. I also added CT target support in the kernel and was working on CT targeting with ftp helper, but it's working now. My guess that USE flag is what I needed. I'll reference some links here just in case others run into this problem. Basically 4.7 and up, Automatic Helpers have been removed.

Original bug:
https://bugs.gentoo.org/show_bug.cgi?id=599354

Helpful site with CT Targeting
https://home.regit.org/netfilter-en/secure-use-of-helpers/

Good information on Helpers
http://shorewall.net/Helpers.html

hanji
_________________
Server Admin Blog - Uno-Code.com | Gentoo Hosting at Rackspace!
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum