Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #160482 > unrolled thread

Are there packages that modify iptables rules?

Back to article view | Back to linux.debian.user

Contents

  Are there packages that modify iptables rules? Patrick Schleizer <patrick-mailinglists@whonix.org> - 2015-11-12 14:50 +0100
    Re: Are there packages that modify iptables rules? Sven Hartge <sven@svenhartge.de> - 2015-11-12 15:00 +0100
      How do packages that modify iptables rules prevent race conditions? Patrick Schleizer <patrick-mailinglists@whonix.org> - 2015-11-12 15:20 +0100
        Re: How do packages that modify iptables rules prevent race conditions? John Hasler <jhasler@newsguy.com> - 2015-11-12 17:30 +0100
        Re: How do packages that modify iptables rules prevent race conditions? Sven Hartge <sven@svenhartge.de> - 2015-11-12 19:40 +0100
        Re: How do packages that modify iptables rules prevent race conditions? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-11-12 20:50 +0100
          Re: How do packages that modify iptables rules prevent race  conditions? Erwan David <erwan@rail.eu.org> - 2015-11-12 21:20 +0100
          Re: How do packages that modify iptables rules prevent race conditions? John Hasler <jhasler@newsguy.com> - 2015-11-12 22:50 +0100

#160482 — Are there packages that modify iptables rules?

Hi,

are there packages that modify the system's iptables rules?

Cheers,
Patrick

[toc] | [next] | [standalone]

#160483

Patrick Schleizer <patrick-mailinglists@whonix.org> wrote:

> are there packages that modify the system's iptables rules?

fail2ban
miniupnpd

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#160484 — How do packages that modify iptables rules prevent race conditions?

Hi,

as I just learned on the mailing list, that at least the packages
fail2ban and miniupnpd [and most likely arno-iptables-firewall also]
modify iptables rules...

Is there a chance for race conditions? I.e. two packages trying to add
iptables rules at the same time and thereby failing to do so?

What is the proper mechanism to add iptables rules [for packages] to
avoid such race conditions?

Is using 'iptables --wait' sufficient or something else?

Cheers,
Patrick

[toc] | [prev] | [next] | [standalone]

#160490 — Re: How do packages that modify iptables rules prevent race conditions?

I think that the best solution would be for the script to construct a
single iptables command string and then run it.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#160492 — Re: How do packages that modify iptables rules prevent race conditions?

Patrick Schleizer <patrick-mailinglists@whonix.org> wrote:

> as I just learned on the mailing list, that at least the packages
> fail2ban and miniupnpd [and most likely arno-iptables-firewall also]
> modify iptables rules...

> Is there a chance for race conditions? I.e. two packages trying to add
> iptables rules at the same time and thereby failing to do so?

fail2ban und miniupnpd create their own chains and a rule to jump to
that personal chain on startup. Subsequent rules are only ever added to
that personal chain. This effectivly avoids any race with different
rules inserted at different places of the ruleset.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#160493 — Re: How do packages that modify iptables rules prevent race conditions?

Patrick Schleizer a écrit :
> 
> as I just learned on the mailing list, that at least the packages
> fail2ban and miniupnpd [and most likely arno-iptables-firewall also]
> modify iptables rules...

Firewall managers such as ufw, shorewall, firestarter...
Custom iptables scripts.
IDS such as portsentry.
"Port knocking" daemons such as knockd.

> Is there a chance for race conditions?

Plenty.

> I.e. two packages trying to add
> iptables rules at the same time and thereby failing to do so?

Yes, or mixing up their rules resulting in unpredictable results.

> What is the proper mechanism to add iptables rules [for packages] to
> avoid such race conditions?
> 
> Is using 'iptables --wait' sufficient or something else?

No it's not. You must also make sure that the rules created by each
program don't disrupt the rules created by the others.

[toc] | [prev] | [next] | [standalone]

#160494 — Re: How do packages that modify iptables rules prevent race conditions?

Le 12/11/2015 20:47, Pascal Hambourg a écrit :
> Patrick Schleizer a écrit :
>> as I just learned on the mailing list, that at least the packages
>> fail2ban and miniupnpd [and most likely arno-iptables-firewall also]
>> modify iptables rules...
> Firewall managers such as ufw, shorewall, firestarter...
> Custom iptables scripts.
> IDS such as portsentry.
> "Port knocking" daemons such as knockd.
>
>> Is there a chance for race conditions?
> Plenty.
>
>> I.e. two packages trying to add
>> iptables rules at the same time and thereby failing to do so?
> Yes, or mixing up their rules resulting in unpredictable results.
>
>> What is the proper mechanism to add iptables rules [for packages] to
>> avoid such race conditions?
>>
>> Is using 'iptables --wait' sufficient or something else?
> No it's not. You must also make sure that the rules created by each
> program don't disrupt the rules created by the others.
>
>

For fail2ban I prefer to use ipset and only modify the blocked set
without changing the rules themselves

[toc] | [prev] | [next] | [standalone]

#160496 — Re: How do packages that modify iptables rules prevent race conditions?

Patrick Schleizer writes:
> I.e. two packages trying to add iptables rules at the same time and
> thereby failing to do so?

They can't do that as each call to iptables locks the table be operated
on.  Without -w iptables exits when it can't get the lock.  With -w it
waits.

Pascal Hambourg writes:
> Yes, or mixing up their rules resulting in unpredictable results.

Yes, that could happen if the programs call iptables multiple times.
Best that programs that manipulate the tables assemble their changes and
install them all with a single call of iptables.  Otherwise you could
have short periods where an unintended ruleset is in effect (or the
program could exit before it completes).  Of course, you still might get
surprises if you run two such programs, but why would you do that?

If you have program that bypasses iptables you're on your own.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web