-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I have a problem with PF logs on OpenBSD 3.4-stable version.

I received a lot of packets from loopback addresse 127.0.0.1 port 80 :
- - TCP RST packets sent by clients infected by Blaster Worm and use of my 
personnal aaddress for IP source spoofing !!!
- - bad configuration from my ISP who routes those packets on Internet, 
contrary to RFC 1918

TCPdump capture :

tcpdump -vnttt -i rl0 host 127.0.0.1
tcpdump: listening on rl0
Jan 09 12:38:42.852200 127.0.0.1.80 > 82.67.44.32.1100: R [tcp sum ok] 
0:0(0) ack 1155203073 win 0 (ttl 124, id 42636)

rl0 is my external interface connected to my ISP with ADSL [Free in France 
with 5.5 Mbps DL line :-)) ].

But I have a problem with PF log for those packets. Indeed, at the same 
time, my PF logs are :

Jan 09 12:17:27.521217 rule 4/0(match): block in on rl0: 82.67.74.157.1025 
> 82.67.44.32.1878: R [tcp sum ok] 0:0(0) ack 1478361089 win 0 (ttl 124, 
id 26924)
Jan 09 12:39:46.932487 rule 5/0(match): block in on rl0: 
61.241.249.22.1034 > 82.67.44.32.1434:  udp 376 (ttl 109, id 12278)
Jan 09 12:58:00.343333 rule 4/0(match): block in on rl0: 82.67.74.157.1025 
> 82.67.44.32.1018: R [tcp sum ok] 0:0(0) ack 159318017 win 0 (ttl 124, id 
26501)

No log for loopback address 127.0.0.1 but my PF rules are :

> sudo pfctl -sr
scrub in all fragment reassemble
block drop out log all
block return-rst out log proto tcp all
block return-icmp(port-unr, port-unr) out log proto udp all
block drop in log all
block return-rst in log proto tcp all
block return-icmp(port-unr, port-unr) in log proto udp all
block drop in log quick on rl0 inet from 127.0.0.0/8 to any
block drop in log quick on rl0 inet from 192.168.0.0/16 to any
block drop in log quick on rl0 inet from 172.16.0.0/12 to any
block drop in log quick on rl0 inet from 10.0.0.0/8 to any
block drop out log quick on rl0 inet from any to 127.0.0.0/8
block drop out log quick on rl0 inet from any to 192.168.0.0/16
block drop out log quick on rl0 inet from any to 172.16.0.0/12
block drop out log quick on rl0 inet from any to 10.0.0.0/8
block drop in log on ! lo0 inet from 127.0.0.0/8 to any
block drop in log on ! lo0 inet6 from ::1 to any
pass in quick on lo0 all
pass out quick on lo0 all
pass in quick on rl1 all
pass out quick on rl1 all (...)

I have 2 rules for logging packets blocked on rl0 (antispoofing on lo0 and 
reject private nets according to RFC 1918) but no packets logged with 
those rules !!!

Some bug on PF or an error in my configuration that I don't understand 
:-(

Thx, Foxy. 

- -- 
Laurent Cheylus <[EMAIL PROTECTED]> OpenPGP ID 0x5B766EC2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE//pOEHFEfP1t2bsIRAh8+AJ0XQt1yT5PooxMe7dCIddpHDp+KUgCfVoIn
E/nMW4MDy9TnG9q5Hpv3YVY=
=82Ic
-----END PGP SIGNATURE-----

Reply via email to