#720306 uruk: incorrectly blocks and logs tcp RSET packets

Package:
uruk
Source:
uruk
Submitter:
Joost van Baal-Ilić
Date:
2013-08-20 10:06:14 UTC
Severity:
normal
#720306#5
Date:
2013-08-20 09:21:38 UTC
From:
To:
Hi,

Op Tue 20 Aug 2013 om 10:53:37 +0200 schreef Wessel Dankers:

сре 14 10:18 < thijs> overigens, ik krijg nog steeds veel van dit soort output in syslog:
                      Aug 14 06:03:34 tnli005 kernel: [2554333.457013] iptables: IN=eth0
                      OUT= MAC=00:50:56:b3:45:d4:00:0e:39:ff:ec:00:08:00 SRC=137.56.247.155
                      DST=137.56.243.55 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP
                      SPT=58041 DPT=443 WINDOW=0 RES=0x00 RST URGP=0
сре 14 10:18 < thijs> 1 per minuut
сре 14 10:19 < Fruit> mja dat is die iptables bug
сре 14 10:19 < thijs> was daar niet een workaround voor aangebracht?
сре 14 10:21 < joostvb> zou gefixed moeten zijn in "uruk version 20120914 - The Sankt Goar
                        Release
сре 14 10:21 < joostvb> "
сре 14 10:24 < thijs> ii  uruk   20130426-1
сре 14 10:25 < joostvb> misschien http://bugs.debian.org/687621 heropenen dan
сре 14 10:27 < Fruit> hmm dit is een RST-pakketje
сре 14 10:27 < Fruit> geen FIN|ACK

uruk now has:

 $iptables -A INPUT --protocol tcp --tcp-flags SYN,ACK,FIN,RST FIN,ACK -j ACCEPT
 $ip6tables -A INPUT --protocol tcp --tcp-flags SYN,ACK,FIN,RST FIN,ACK -j ACCEPT

would adding

 $iptables -A INPUT --protocol tcp --tcp-flags SYN,ACK,FIN,RST RST -j ACCEPT
 $ip6tables -A INPUT --protocol tcp --tcp-flags SYN,ACK,FIN,RST RST -j ACCEPT

fix it?  Is this yet another bug in iptables?

Bye,

Joost
#720306#10
Date:
2013-08-20 10:03:20 UTC
From:
To:
the story behind this: we are client and initialize outgoing tcp session.
return traffic gets allowed since matching state.  incoming rset packet gets
received, apparently kernel doesn't recognize it as belonging to a tcp-session
being shut down, and can't match the state.

would tweaking one of net.ipv4.netfilter.ip_conntrack_tcp* sysctl flags be
better?