netdev - Re: VPN traffic leaks in IPv6/IPv4 dual-stack networks/hosts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 27 Nov 2012 08:04:12 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Fernando Gont <fernando@...t.com.ar>
Cc:	netdev <netdev@...r.kernel.org>
Subject: Re: VPN traffic leaks in IPv6/IPv4 dual-stack networks/hosts

On Tue, 2012-11-27 at 11:54 -0300, Fernando Gont wrote:
> Folks,
> 
> FYI. This is might affect Linux users employing e.g. OpenVPN:
> <http://tools.ietf.org/html/draft-gont-opsec-vpn-leakages>.
> 
> For a project such as OpenVPN, a (portable) fix might be non-trivial.
> However, I guess Linux might hook some iptables rules when establishing
> the VPN tunnel, such that e.g. all v6 traffic is filtered (yes, this is
> certainly not the most desirable fix, but still probably better than
> having your supposedly-secured traffic being sent in the clear).
> 
> P.S.: Not sure if this is the right list to send this note. Please
> advice of a more appropriate one and/or feel free to forward this note
> if deemed appropriate...

This seems a user space issue to me.

accept_ra on linux is set to 1, meaning that as soon as forwarding is
enabled, RA are ignored.



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html