[Oisf-devel] [Oisf-users] Suricata - Write to ipfw divert socket failed

Shirkdog shirkdog at gmail.com
Thu Mar 6 17:24:19 UTC 2014


I normally treat the divert as first in the chain (as a single rule)

ipfw add 100 divert 8000 all from any to any not layer2

I am not sure how even FreeBSD 10 will work with having two divert
rules. It should be a short circuit to detection, if all is well,
packet is evaluated by the rest of the rules.

---
Michael Shirk


On Thu, Mar 6, 2014 at 3:48 AM, Özkan KIRIK <ozkan.kirik at gmail.com> wrote:
> Hi Eric,
>
> I addded a printf into source-ipfw.c line 557.
>
>                         PrintInet(AF_INET, (const void *)
> GET_IPV4_SRC_ADDR_PTR(p), srcip, srcip_len);
>                         PrintInet(AF_INET, (const void *)
> GET_IPV4_DST_ADDR_PTR(p), dstip, dstip_len);
>                         printf( "fd: %d, data_p: %p, length: %u ", nq->fd,
> GET_PKT_DATA(p),GET_PKT_LEN(p) );
>                         printf( "src ip : %s ", srcip );
>                         printf( "dst ip : %s\n", dstip );
>
> But i saw that, these packets are routable packets. I don't think that
> problem is about non routable packages.
>
> fd: 7, data_p: 0x8045ce578, length: 95 src ip : 10.2.2.10 dst ip :
> 92.83.122.63
> 6/3/2014 -- 10:41:24 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:24 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 9118, dropped 3
> 6/3/2014 -- 10:41:24 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8045eeb78, length: 58 src ip : 10.2.2.10 dst ip :
> 116.193.135.211
> 6/3/2014 -- 10:41:24 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:24 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 35, dropped 0
> 6/3/2014 -- 10:41:24 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8044cc378, length: 58 src ip : 10.2.2.10 dst ip :
> 220.255.54.21
> 6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 8877, dropped 0
> 6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8044cd178, length: 58 src ip : 10.2.2.10 dst ip :
> 220.255.1.178
> 6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 1, dropped 0
> 6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8044cdf78, length: 58 src ip : 10.2.2.10 dst ip :
> 223.29.197.237
> 6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 1, dropped 0
> 6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8044ced78, length: 58 src ip : 10.2.2.10 dst ip :
> 109.161.142.206
> 6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 1, dropped 0
> 6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8044cfb78, length: 58 src ip : 10.2.2.10 dst ip :
> 110.175.191.10
> 6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 1, dropped 0
> 6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8044d0978, length: 58 src ip : 10.2.2.10 dst ip :
> 110.74.201.253
> 6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 1, dropped 0
> 6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8044d1778, length: 58 src ip : 10.2.2.10 dst ip :
> 110.175.99.68
> 6/3/2014 -- 10:41:43 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:43 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 1, dropped 0
> 6/3/2014 -- 10:41:43 - <Info> - thread "Verdict0" restarted
> fd: 7, data_p: 0x8044c2978, length: 60 src ip : 10.2.2.10 dst ip :
> 224.0.0.252
> 6/3/2014 -- 10:41:53 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write
> to ipfw divert socket failed: Permission denied
> 6/3/2014 -- 10:41:53 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted
> 6114, dropped 0
> 6/3/2014 -- 10:41:53 - <Info> - thread "Verdict0" restarted
>
>
>
>
>
> On Thu, Mar 6, 2014 at 9:17 AM, Özkan KIRIK <ozkan.kirik at gmail.com> wrote:
>>
>> ipfw -ad list
>>
>> 00004          0             0 deny ip from any to any MAC
>> e8:03:9a:0f:74:7b any
>> 00005   63668675   49628511386 allow ip from any to any layer2
>> 00100      25849      4724396 divert 8000 all from any to 10.2.2.10 not
>> layer2
>> 00200      26579      5122809 divert 8000 all from 10.2.2.10 to any not
>> layer2
>> 00300     365312      25436015 skipto 600 udp from any to any dst-port
>> 53,1812
>> 00400     334817      71431398 skipto 600 udp from any 53,1812 to any
>> 00500      77815       5612395 deny udp from any to any
>> 00600    4928083    1457516245 nat tablearg ip from table(10) to any via
>> igb1 // VLAN NAT
>> 00600   13655296   16815414254 nat tablearg ip from any to table(11) via
>> igb1 // VLAN NAT
>> ##Dynamic rules:
>>
>>
>>
>> On Thu, Mar 6, 2014 at 1:02 AM, Eric Leblond <eric at regit.org> wrote:
>>>
>>> Hi,
>>>
>>> On Thu, 2014-03-06 at 00:55 +0200, Özkan KIRIK wrote:
>>> > I tried to compile both clang and gcc. Result was same.
>>> >
>>> > This error appears sometimes. Not for all packets.
>>> >
>>> > There is only one rule : pass ip any any -> any any
>>>
>>> There is an old memory coming back to me. Not sure but I think this is
>>> linked with non routable packet reaching the filter (packet going to the
>>> box for example). And there is a failure at reinject because the packet
>>> can't be send.
>>>
>>> BR,
>>>
>>> >
>>> >
>>> > 6 Mar 2014 00:49 tarihinde "Özkan KIRIK" <ozkan.kirik at gmail.com>
>>> > yazdı:
>>> >         Hi,
>>> >
>>> >         I was running suricata with these arguments;
>>> >
>>> >         suricata -vv -d 8000
>>> >
>>> >         ipfw add divert 8000 all from any to 10.2.2.10
>>> >         ipfw add divert 8000 all from 10.2.2.10 to any
>>> >
>>> >         6 Mar 2014 00:45 tarihinde "Shirkdog" <shirkdog at gmail.com>
>>> >         yazdı:
>>> >                 Do you have ipfw setup with the divert socket set to a
>>> >                 port?
>>> >
>>> >                 On Mar 5, 2014 5:17 PM, "Özkan KIRIK"
>>> >                 <ozkan.kirik at gmail.com> wrote:
>>> >                         Hi,
>>> >
>>> >
>>> >                         I'm using FreeBSD 10 ipfw and ipdivert
>>> >                         enabled.
>>> >                         I tried suricata v.1.4.6, v1.4.7 and also
>>> >                         2.0rc1.
>>> >
>>> >
>>> >                         All versions throws this error sometimes
>>> >                         "<Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)]
>>> >                         - Write to ipfw divert socket failed:
>>> >                         Permission denied"
>>> >                         After a while, thread restart threshold
>>> >                         exceeded and suricata completely shutdown.
>>> >
>>> >
>>> >                         I was diverted only 1 host to suricata. But
>>> >                         still gives this error.
>>> >
>>> >
>>> >                         It's strange, I inspected the source-ipfw.c
>>> >                         file. The problem about injecting packet back
>>> >                         to divert socket.
>>> >
>>> >
>>> >                         errno = 13 - EACCESS.
>>> >
>>> >
>>> >                         I saw that SO_BROADCAST option was set to
>>> >                         socket.
>>> >
>>> >
>>> >                         How can i debug this situation, or any
>>> >                         solutions?
>>> >
>>> >
>>> >                         Best regards
>>> >
>>> >                         _______________________________________________
>>> >                         Suricata IDS Users mailing list:
>>> >                         oisf-users at openinfosecfoundation.org
>>> >                         Site: http://suricata-ids.org | Support:
>>> >                         http://suricata-ids.org/support/
>>> >                         List:
>>> >
>>> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>> >                         OISF: http://www.openinfosecfoundation.org/
>>> > _______________________________________________
>>> > Suricata IDS Devel mailing list: oisf-devel at openinfosecfoundation.org
>>> > Site: http://suricata-ids.org | Participate:
>>> > http://suricata-ids.org/participate/
>>> > List:
>>> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>>> > Redmine: https://redmine.openinfosecfoundation.org/
>>>
>>> --
>>> Eric Leblond <eric at regit.org>
>>>
>>
>



More information about the Oisf-devel mailing list