Hello,
Following up with this issue, I found out that if frags arrive in
straight (not reverse) order to ipf, they get through just fine.
As second experiment I used another Solaris (not Linux now) box to
originate fragmented UDP:
tcpdump:
IP 66.193.176.41.44917 > 66.193.84.149.5060: UDP, length: 1493
IP 66.193.176.41 > 66.193.84.149: udp
IP 66.193.84.149 > 66.193.176.41: icmp 92: 66.193.84.149 udp port 5060
unreachable
(we see that frags go in straight order now, and they get through
firewall - there's icmp unreach from kernel)
ipfstat -f
IP fragment states:
1 new
1 expired
1 hits
0 no memory
0 already exist
0 inuse
Note that ipf now got "HIT" on a frag! no more packets stuck in buffers.
ipmon:
11/11/2004 15:45:58.773961 STATE:NEW 66.193.176.41,44917 ->
66.193.84.149,5060 PR udp
11/11/2004 15:47:58.450136 STATE:EXPIRE 66.193.176.41,44917 ->
66.193.84.149,5060 PR udp Pkts 2 Bytes 1612
Now it is clear that ipf does not handle fragmented UDP properly when
fragments come out of order. Any comments?
-Alex Zhilyakov
Network Manager, Accatel Inc.
+1-212-3794000
On Thu, 11 Nov 2004, Alex Zhilyakov wrote:
> Hello,
>
> I'm having weird problems with fragmented UDP and ipf. ipf is set to
> "pass... udp... keep frags". However, if UDP comes fragmented, it does not
> get to my application.
>
> This is what I see in tcpdump:
> IP 66.193.84.130 > 66.193.84.149: udp
> IP 66.193.84.130.32795 > 66.193.84.149.5060: UDP, length: 1493
> (note that 2nd frag comes before 1st frag)
>
>
> This is what ipmon shows:
> 11/11/2004 14:53:05.761101 STATE:NEW 66.193.84.130,32795 ->
> 66.193.84.149,5060 PR udp
>
>
> BUT, the fragments are stuck in ipf buffers and do not get through:
> #ipfstat -f
> IP fragment states:
> 2 new
> 1 expired
> 0 hits
> 0 no memory
> 0 already exist
> 1 inuse
> 66.193.84.130 -> 66.193.84.149 50499 112 17 00 = 0x580a
>
> And this fragment sits there until it expires in few minutes:
>
> 11/11/2004 14:55:05.410123 STATE:EXPIRE 66.193.84.130,32795 ->
> 66.193.84.149,5060 PR udp Pkts 2 Bytes 1612
>
> #ipfstat -f
> IP fragment states:
> 2 new
> 2 expired
> 0 hits
> 0 no memory
> 0 already exist
> 0 inuse
>
> ipf config:
> #ipfstat -io
> empty list for ipfilter(out)
> pass in quick on hme0 proto icmp from any to any
> pass in quick on hme0 proto udp from any to any port = 5060 keep state
> keep frags
> pass in quick on hme0 proto udp from any port = 53 to any
> pass in quick on hme0 proto tcp from any to any port = 22 flags S/FSRPAU
> keep state keep frags
> block in on hme0 from any to any
> #ipf -V
> ipf: IP Filter: v3.4.32 (496)
> Kernel: IP Filter: v3.4.32
> Running: yes
> Log Flags: 0 = none set
> Default: pass all, Logging: available
> Active list: 1
>
>
> Could somebody have a look at all this and provide comments on it, or
> suggest how to solve the problem? Thank you.
>
>
> -Alex Zhilyakov
> Network Manager, Accatel Inc.
> +1-212-3794000
>
>
>
