netdev - Re: [PATCH] route: add more relaxed option for secure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111116234042.6ad8d723@asterix.rh>
Date:	Wed, 16 Nov 2011 23:40:42 -0200
From:	Flavio Leitner <fbl@...hat.com>
To:	Flavio Leitner <fbl@...hat.com>
Cc:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH] route: add more relaxed option for secure_redirects

On Wed, 16 Nov 2011 21:17:38 -0200
Flavio Leitner <fbl@...hat.com> wrote:

> On Wed, 16 Nov 2011 17:02:13 -0500 (EST)
> David Miller <davem@...emloft.net> wrote:
> 
> > From: Flavio Leitner <fbl@...hat.com>
> > Date: Wed, 16 Nov 2011 18:46:12 -0200
> > 
> > > Thus, the only option at the sender side would be using iptables
> > > to change the ICMP redirect source address to be the float
> > > address, but that is not working as well. (It isn't passing
> > > through -t nat)
> > 
> > If it's going to mangle the packet in one direct, the only option
> > for sane operation is to make the exact reverse transformation in
> > the other direction for ICMP messages.
> > 
> > I'm sorry to be so difficult about this, but this is the only way to
> > handle this problem.  If packet mangling is performed to change the
> > world, that mangling entity has taken on the responsibility to make
> > everything look correct to all entities for the mangled packets
> > and any packets generated in response to such mangled packets.
> >
> 
> I'm sorry, I lost you there. There is no transformation happening in
> any side. The iptables is just a work around to force the outgoing
> ICMP redirect to use the correct source address (secondary or alias). 
> 
> The whole problem is the linux gateway sending ICMP redirects using
> *always* the primary address.
> 

To make sure we are in the same page, this simple setup reproduces
the issue.

IP: 10.0.0.1
gw: 10.0.0.100
+--------+          +-----+ primary: 10.0.0.2
| client |----+-----| GW1 |   alias: 10.0.0.100
+--------+    |     +-----+      gw: 10.0.0.254
           +--+--+
           | GW2 |---> internet
           +-----+
         10.0.0.254

1. Client sends TCP SYN to an internet host using
   GW1 alias address as default gw address

2. Then GW1 sends the ICMP redirect back to client
   using the primary address as source address.

3. GW1 forwards the original packet to GW2

4. client ignores the ICMP redirect because
   client.gw != gw1.primary.

Regards,
fbl
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html