Disable conntrack helper?

[phabricator-migrator]

Information

ID: 486
PHID: PHID-TASK-kospa46pjwtqky3y6tdg
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

cat /proc/sys/net/netfilter/nf_conntrack_helper

Reasoning:
https://mailman.boum.org/pipermail/tails-dev/2014-December/007537.html

Perhaps useful:
https://labs.riseup.net/code/issues/11391

TODO:

• test this for a while and see if anything major breaks
• disable nf_conntrack_helper

Comments

---

HulaHoop

2016-03-29 23:37:00 UTC

Very dangerous feature that allows a bunch of unsafe protocols to be parsed in the kernel when they have no business there:

Secure use of iptables and connection tracking helpers – To Linux and beyond !

Will you disable it by blacklisting the module before it loads:

modprobe nf_conntrack nf_conntrack_helper=0

or with sysctl after it loads?

echo 0 > /proc/sys/net/netfilter/nf_conntrack_helper

---

Patrick

2016-03-29 23:48:07 UTC

Not using echo, that would be a non-ideal implementation.

Probably using /etc/sysctl.d should be appropriate, well auditable,
configurable.

---

HulaHoop

2016-03-30 05:13:09 UTC

Found it. The sysctl.d paramter is:

net.netfilter.nf_conntrack_helper =0

I think its best if the tcp-timestamps-disable package is extended as a general hardening package for the network and its name changed to someything like “safe-networking” instead.

I am willing to change the name in every other package’s depends section if there is a way enumerate them all.

---

HulaHoop

2016-03-30 15:38:09 UTC

tcp-timestamps-disable
Reverse Depends:
anon-shared-packages-dependencies

---

Patrick

2016-03-30 19:00:40 UTC

Should we also disable conntrack helper in Qubes? @marmarek

I was wondering if the tcp-timestamps-disable package should be merged
into the security-misc package. Disabling conntrack helper might fit
into the security-misc package?

---

marmarek

2016-03-30 19:11:24 UTC

Should we also disable conntrack helper in Qubes?

I think so.

I was wondering if the tcp-timestamps-disable package should be merged
into the security-misc package. Disabling conntrack helper might fit
into the security-misc package?

Good idea.

---

HulaHoop

2016-03-31 03:30:18 UTC

I added the changes to security-misc. I formatted debian/control to follow packaging rules but the formatting looks ugly in the README.

I looked for a anon-shared-packages-dependencies metapackage to change dependencies but couldn’t find it.

After these small tweaks tcp-timestamps-disable can be deleted - I can’t do a pull for that.

---

Patrick

2016-03-31 03:43:49 UTC

So we should do this for #Whonix13 already? Might be doable.

Did you try enabling this setting in your Whonix VMs and host yet? Did
it cause any obvious issues?

HulaHoop (HulaHoop):

I looked for a anon-shared-packages-dependencies metapackage to change dependencies but couldn’t find it.

Use grep from the Whonix source code folder.

grep --exclude-dir=.git -r tcp-timestamps-disable

It’s here:

anon-meta-packages/debian/control at 9bf7e5764d80bc449de285552acb2c33b839aa15 · Whonix/anon-meta-packages · GitHub

---

Patrick

2016-03-31 03:45:16 UTC

Create tcp_timestamps.conf by HulaHoopWhonix · Pull Request #1 · Kicksecure/security-misc · GitHub

---

Patrick

2016-03-31 03:53:00 UTC

! In T486#8529, @HulaHoop wrote:
I formatted debian/control to follow packaging rules but the formatting looks ugly in the README.

The README.md can be automatically generated from debian/control. (Also should be. Otherwise these have to be manually merged upon next run of the auto generator.)

How?

Get into Whonix folder packages/whonix-developer-meta-files

General overview. (No other documentation. Requires reading the source and it’s supposed to be used by devs only.)

./debug-steps/packaging-helper-script

Readme creation.

./debug-steps/packaging-helper-script pkg_readme_creator

---

HulaHoop

2016-03-31 14:56:01 UTC

So we should do this for #Whonix13 already? Might be doable.

Yes its worth it.

Did you try enabling this setting in your Whonix VMs and host yet? Did
it cause any obvious issues?

Tried it with no negative effects so far.

The README.md can be automatically generated from debian/control.

I just wanted to check with you debian/control looks good.

Fixed dependencies.

---

Patrick

2016-03-31 15:33:44 UTC

Please post your links to the pull requests so everyone can keep track of them (and in case github mailer does not work).

https://github.com/Whonix/anon-meta-packages/pull/1

---

Fixed dependencies.

There is no point to have both anon-shared-packages-dependencies and anon-shared-packages-recommended depend on security-misc. Should just be one or the other. Otherwise if you keep enforcing the duplicate dependency we would have to do that for a lot other packages also and that does seem counter useful.

---

Patrick

2016-03-31 15:56:47 UTC

Don’t copy from github web - it eats formatting such as leading spaces. If anything, copy from gitub raw, or for better security directly from local file.

---

• added 'Replaces: tcp-timestamps-disable' · Kicksecure/security-misc@d5e61eb · GitHub
• fixed package description and package description linitan warnings · Kicksecure/security-misc@9d7ad9e · GitHub

---

Patrick

2016-03-31 15:58:33 UTC

https://github.com/Whonix/Whonix/commit/2082200bd6bda6442bb36ec6f849f1b30c87233c

---

Patrick

2016-04-21 18:10:34 UTC

Doesn’t work. The file is in place.

https://github.com/Whonix/security-misc/blob/master/etc/sysctl.d/nf_conntrack_helper.conf

Yet, conntrack still is enabled!

cat /proc/sys/net/netfilter/nf_conntrack_helper

1

The config file notation net.netfilter.nf_conntrack_helper=0 vs net.netfilter.nf_conntrack_helper = 0 does not make a difference. (But as per other files in /etc/sysctl.d both formats should work.)

Any idea?

---

HulaHoop

2016-04-22 15:52:14 UTC

Looks like disabling the helper is more complicated because of module dependencies:
secure-conntrack-helpers/secure-conntrack-helpers.rst at master · regit/secure-conntrack-helpers · GitHub

Instructions: Disable Helper by default

Another module “nf_conntrack” has to be blacklisted in modprobe .

---

Patrick

2016-04-25 20:05:36 UTC

How to disable conntrack protocol parsing in the linux kernel?:
firewalls - How to disable conntrack protocol parsing in the linux kernel? - Information Security Stack Exchange

---

Patrick

2016-04-25 23:28:19 UTC

Disabled for now as it needs more work.

/etc/sysctl.d/nf_conntrack_helper.conf disabled for now as it needs m… · Kicksecure/security-misc@192d1e0 · GitHub

I am also wondering if we are chasing a ghost here. As long as we are not using --helper ftp or similar, the protocol parser code might not be used.

Also in /usr/bin/whonix_firewall we are using -m conntrack. So totally disabling conntrack may not be possible.

---

HulaHoop

2016-04-26 16:05:09 UTC

That explains it. If iptables rules rely on the module it will be enabled: linux - how do I disable the nf_conntrack kernel module in CentOS 5.3 without recompiling the kernel - Server Fault. Also there are tips on the web to make iptables rules more DoS resistant by disabling conntracking. Is it possible to replace these rules or are they necessary?

What I understand from Jacob’s message is that by having this module enabled you expose all the code paths to malicious input.

---

marmarek

2016-04-26 21:09:34 UTC

I think blacklisting specific conntrack helpers modules should be
enough. After all we want to disable protocols parsing code, not the
conntrack itself. Also adding appropriate check to whonixcheck is a good
thing.

---

Patrick

2016-06-03 21:11:21 UTC

https://labs.riseup.net/code/issues/11391

---

Patrick

2016-10-10 16:17:58 UTC

disable conntrack helper for better security · Kicksecure/security-misc@6cda8b1 · GitHub

---

Patrick

2016-12-18 22:17:38 UTC

I don’t know what to think of this which warns of conntrack… [tor-talk] Intel ME / AMT + NSL vs Tor Nodes

But anyhow. If less attack surface can be exposed in the kernel… Maybe we can not only get rid of conntrack helpers but also of conntrack generally.

The remaining use of conntrack in Whonix…

---

Whonix generally:

May not be wise to remove…

## https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html
$iptables_cmd -A OUTPUT -m conntrack --ctstate INVALID -j REJECT --reject-with icmp-admin-prohibited
$iptables_cmd -A OUTPUT -m state --state INVALID -j REJECT --reject-with icmp-admin-prohibited

May not be possible to remove…

 $iptables_cmd -A INPUT -m state --state ESTABLISHED -j ACCEPT

---

Qubes-Whonix for updates proxy only:

Removing those works fine… Those both have pros and cons so hard to make a decision.

$iptables_cmd -t nat -A OUTPUT -p udp -m owner --uid-owner tinyproxy -m conntrack --ctstate NEW -j DNAT --to "127.0.0.1:${DNS_PORT_GATEWAY}"

$iptables_cmd -t nat -A OUTPUT -p tcp -m owner --uid-owner tinyproxy -m conntrack --ctstate NEW -j DNAT --to "127.0.0.1:${TRANS_PORT_GATEWAY}"

$iptables_cmd -t nat -A OUTPUT -p udp -m owner --uid-owner vm-updates -m conntrack --ctstate NEW -j DNAT --to "127.0.0.1:${DNS_PORT_GATEWAY}"

$iptables_cmd -t nat -A OUTPUT -p tcp -m owner --uid-owner vm-updates -m conntrack --ctstate NEW -j DNAT --to "127.0.0.1:${TRANS_PORT_GATEWAY}"

---

marmarek

2016-12-19 00:38:08 UTC

! In T486#11057, @Patrick wrote:
I don’t know what to think of this which warns of conntrack… [tor-talk] Intel ME / AMT + NSL vs Tor Nodes

I think it’s a wrong link.

But anyhow. If less attack surface can be exposed in the kernel… Maybe we can not only get rid of conntrack helpers but also of conntrack generally.

Doesn’t NAT use conntrack too?

May not be possible to remove…

 $iptables_cmd -A INPUT -m state --state ESTABLISHED -j ACCEPT

Yes, this would be hard to replace with anything else (if possible at all).

---

HulaHoop

2016-12-19 01:12:03 UTC

I think it’s a wrong link.

True. It think Patrick meant this message which mentions conntrack.

[tor-talk] Intel ME / AMT + NSL vs Tor Nodes

Maybe the guy is talking about conntrack helper, which we’ve known to be problematic for some time now.