Re: [tor-talk] Linux kernel transproxy packet leak (w/ repro case + workaround)

[Soul Plane <soulplane11@xxxxxxxxx>]

On Fri, Mar 28, 2014 at 5:34 PM, Mike Perry <mikeperry@xxxxxxxxxxxxxx>wrote:

> Here's a set of rules to try both --ctstate and --state invalid, as well
> as log which ones get hit, for testing purposes. Note the use of -A in
> this case, for readability wrt ordering. These rules should come before
> any other rule in the OUTPUT chain section of the firewall script you
> use:
>
> #iptables -A OUTPUT -m conntrack --ctstate INVALID -j LOG --log-prefix
> "Transproxy ctstate leak blocked: " --log-uid
> iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP
> iptables -A OUTPUT -m state --state INVALID -j LOG --log-prefix
> "Transproxy state leak blocked: " --log-uid
> iptables -A OUTPUT -m state --state INVALID -j DROP
>
> iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp
> --tcp-flags ACK,FIN ACK,FIN -j LOG --log-prefix "Transproxy leak blocked: "
> --log-uid
> iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp
> --tcp-flags ACK,RST ACK,RST -j LOG --log-prefix "Transproxy leak blocked: "
> --log-uid
> iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp
> --tcp-flags ACK,FIN ACK,FIN -j DROP
> iptables -A OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp
> --tcp-flags ACK,RST ACK,RST -j DROP
>
> It's likely only the first pair is needed, and you may want to comment
> out the --ctstate LOG line as I did to limit noise for successfully
> handled --ctstate INVALID DROP blocks.
>
> I did test this with the above repro method, and --ctstate INVALID did
> appear sufficient by itself, but reports of any --ctstate DROP rule
> bypass happening will be tremendously useful (which will result in the
> later LOG lines being hit, and sending output to 'dmesg').
>
>
I have an Ubuntu middlebox to torify. It uses TransListenAddress,
TransPort. One interface accepts incoming traffic that will be torified.
The connections to the tor network go out on the other interface which can
access the internet unrestricted. I can't find the original directions I
used to set it up. The Torbox page I have commented in my config now says
it's been replaced by Whonix. I tried the wiki there but it doesn't load:
http://sourceforge.net/p/whonix/wiki/ Does what you're saying apply to a
setup like mine? Thanks
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk