0000239: blocking finger protocol is overly aggressive

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0000239

ClearOS

deprecated - ClearOS 5 Protocol Filter

public

2011-02-18 15:06

2012-04-18 19:39

Reporter

therevmj

Assigned To

dsokoloski

Priority

normal

Severity

minor

Reproducibility

always

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

5.2-SP1

Target Version

Fixed in Version

6.2.0 Beta 2

Summary

0000239: blocking finger protocol is overly aggressive

Description

If you enable blocking of the finger protocol, many other protocols are also blocked.

Additional Information

The pattern used for blocking the finger protocol (found in /etc/l7-filter/protocols/protocols/finger.pat) is:
^[a-z][a-z0-9\-_]+|login: [\x09-\x0d -~]* name: [\x09-\x0d -~]* Directory:

The exceedingly problematic portion is:
^[a-z][a-z0-9\-_]+

Given the fact that the l7 filters are case insensitive, this meas that any protocal that sends packets that start out with a letter followed by at least one letter, number, -, or _ will match.

I can only say for certain that http traffic is blocked when this rule is enabled, others should be affected as well (ssh because the banner starts out with 'SSH').

This rule either needs to be restricted to the default finger port of 79, or the pattern needs to be modified such that it does not block http and ssh protocols.

Unfortunately, I am not familiar enough with the finger protocol to provide any recommendations in regards to possible pattern modifications.

Tags

No tags attached.

Attached Files

finger.txt [^] (1,891 bytes) 2011-10-27 15:03 [Show Content] [Hide Content]

00000000  64 61 72 72 79 6c                                darryl 
00000006  0d 0a                                            ..

    00000000  0d 0a 57 65 6c 63 6f 6d  65 20 74 6f 20 4c 69 6e ..Welcom e to Lin 
    00000010  75 78 20 76 65 72 73 69  6f 6e 20 33 2e 30 2e 36 ux versi on 3.0.6 
    00000020  2d 74 75 78 6f 6e 69 63  65 20 61 74 20 67 6c 69 -tuxonic e at gli 
    00000030  74 63 68 2e 6c 61 6e 20  21 0d 0a 0a             tch.lan  !...  
    0000003C  20 31 36 3a 34 35 3a 34  36 20 75 70 20 31 20 64  16:45:4 6 up 1 d 
    0000004C  61 79 2c 20 32 30 3a 35  37 2c 20 20 31 20 75 73 ay, 20:5 7,  1 us 
    0000005C  65 72 2c 20 20 6c 6f 61  64 20 61 76 65 72 61 67 er,  loa d averag 
    0000006C  65 3a 20 30 2e 30 32 2c  20 30 2e 31 30 2c 20 30 e: 0.02,  0.10, 0 
    0000007C  2e 31 30 0a                                      .10.  
    00000080  0d 0a                                            ..

    00000082  4c 6f 67 69 6e 3a 20 64  61 72 72 79 6c 20 20 20 Login: d arryl   
    00000092  20 20 20 20 20 20 09 09  09 4e 61 6d 65 3a 20 0d       .. .Name: .  
    000000A2  0a 44 69 72 65 63 74 6f  72 79 3a 20 2f 68 6f 6d .Directo ry: /hom 
    000000B2  65 2f 64 61 72 72 79 6c  20 20 20 20 20 20 20 20 e/darryl         
    000000C2  20 20 20 20 20 09 53 68  65 6c 6c 3a 20 2f 62 69      .Sh ell: /bi 
    000000D2  6e 2f 62 61 73 68 0d 0a  4f 6e 20 73 69 6e 63 65 n/bash.. On since 
    000000E2  20 54 68 75 20 4f 63 74  20 32 37 20 31 35 3a 33  Thu Oct  27 15:3 
    000000F2  36 20 28 45 44 54 29 20  6f 6e 20 74 74 79 38 20 6 (EDT)  on tty8 
    00000102  66 72 6f 6d 20 3a 30 0d  0a 20 20 20 31 20 64 61 from :0. .   1 da 
    00000112  79 20 32 30 20 68 6f 75  72 73 20 69 64 6c 65 0d y 20 hou rs idle.  
    00000122  0a 4e 6f 20 6d 61 69 6c  2e 0d 0a 4e 6f 20 50 6c .No mail ...No Pl 
    00000132  61 6e 2e 0d 0a                                   an...

Relationships

Notes
(0000384) dsokoloski (developer) 2011-10-27 15:10	Unfortunately l7-filter does not combine content matching with protocol details such as source or destination address/port. The finger protocol pattern is already listed as under and over-matching. Due to the nature of the protocol (See http://tools.ietf.org/html/rfc1288 [^]), there is no easy way to block this protocol using pattern matching. It's recommended to add a blocking firewall rule for TCP traffic on port 79 rather than use this pattern. However, I have updated the pattern to also require a match on 0x0d 0x0a at the end of the login name. This will improve the accuracy slightly and reduce over-matches for some protocols (SSH, HTTP headers), but will still over-match for any string that contains a-z + a-z0-9-_ and ends with CRLF.

Issue History
Date Modified	Username	Field	Change
2011-02-18 15:06	therevmj	New Issue
2011-03-02 15:45	user2	Status	new => confirmed
2011-10-24 14:27	user2	Status	confirmed => assigned
2011-10-24 14:27	user2	Assigned To	=> dsokoloski
2011-10-27 15:03	dsokoloski	File Added: finger.txt
2011-10-27 15:10	dsokoloski	Note Added: 0000384
2011-10-27 15:11	dsokoloski	Status	assigned => resolved
2011-10-27 15:11	dsokoloski	Resolution	open => fixed
2011-10-27 15:11	dsokoloski	Fixed in Version	=> 6.1 Beta 2
2012-04-18 19:39	user2	Status	resolved => closed
2018-01-15 16:31	user2	Category	app-protocol-filter - Protocol Filter Manager => app-protocol-filter - ClearOS 5
2018-01-15 16:32	user2	Category	app-protocol-filter - ClearOS 5 => deprecated - ClearOS 5 Protocol Filter

ClearOS Bug Tracker