kern/128902: ipfw allow tcp from any to any established allow Sync pass through

[Jin Guojun]

>Number:         128902
>Category:       kern
>Synopsis:       ipfw allow tcp from any to any established allow Sync pass through
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Nov 16 05:10:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Jin Guojun
>Release:        RELEASE 6.3
>Organization:
>Environment:
FreeBSD Belkin 6.3-RELEASE FreeBSD 6.3-RELEASE #0: Fri Oct 31 00:25:31 PDT 2008     root at Belkin:/usr/src/sys/i386/compile/Firewall  i386
>Description:
According to ipfw rule, the tcp established rule should allow only connected TCP traffic pass through. Non established TCP traffic (Sync packet) should not allowed to pass by this rule. However, this seems failing in RELEASED 6.3 (it seems working before as we used this rule for long time). The following rule set order should cut tcp connecting traffic from those 4 IP addresses, but it failed to do so.

00330 3108378 2700826874 allow tcp from any to any established
00361       0          0 deny ip from 203.83.248.93 to any
00361       0          0 deny ip from 72.30.142.215 to any
00567       0          0 deny ip from 193.200.241.171 to any
00567       0          0 deny ip from 221.192.199.36 to any
65535       2        120 deny ip from any to any


>How-To-Repeat:
221.192.199.36 is a malicious site that probes computer holes around the whole world  in period of every one half hour.
Set ipfw rule described in Full description and Listen on TCP port 80 to see TCP connection coming through.

If you have a outside IP (say XIP), you can set it in rule set 00555 for
00555 deny ip from XIP to any
and listen on a TCP port (say 12345) on local host, then send TCP traffic from XIP host to your local host TCP port 12345, and watch the traffic is passing through.
>Fix:
Have no looked into code yet, but by guessing, the ipfw did not take care the Sync case for established TCP rule, or it is bypassed or overwritten by other rules.

>Release-Note:
>Audit-Trail:
>Unformatted: