| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 8 Aug 2023 15:11:31 +0800 From: Yu Yat Ho <lagoho7@...il.com> To: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com Cc: netdev@...r.kernel.org Subject: Re: [Linux Bug Report] Binding to IP address using bind(2) seems to leak traffic to other interfaces Didn't realise I was supposed to file a bug report to the Linux distribution I was using instead of directly emailing you. Terribly sorry for taking up your precious time. Just in case you are interested, the bug report I filed is at https://bugzilla.redhat.com/show_bug.cgi?id=2229902. Best regards, Yat On Tue, 8 Aug 2023 at 11:34, Yu Yat Ho <lagoho7@...il.com> wrote: > > Hi all, > > I hope this is the correct place to report the bug I am experiencing. > > The problem I am seeing is that data sent through a socket bound using bind(2) seems to be leaking to other network interfaces in the system. Here are some brief steps to demonstrate the problem, it works using wget too: > > Set up a Linux VM (I am using Fedora 38 on VirtualBox) that has one NAT interface (has Internet access) and one host-only interface (no Internet access). > Try to send a request using curl that is bound to the host-only interface using its interface name. It should fail to connect as expected. > > $ curl --interface enp0s8 icanhazip.com > > Try to send another request, this time bind to the host-only interface using IP address. It will somehow successfully get a response. > > $ curl --interface 192.168.56.103 icanhazip.com > > The tcpdump output shows that the packets were originated from the NAT interface (enp0s3 is the NAT interface), but they have the source IP of the host-only interface: > > # tcpdump -i any -nn host icanhazip.com > tcpdump: data link type LINUX_SLL2 > dropped privs to tcpdump > tcpdump: verbose output suppressed, use -v[v]... for full protocol decode > listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes > 10:56:34.264997 enp0s3 Out IP 192.168.56.103.57656 > 104.18.114.97.80: Flags [S], seq 2864717259, win 64240, options [mss 1460,sackOK,TS val 1169355339 ecr 0,nop,wscale 7], length 0 > 10:56:35.320888 enp0s3 Out IP 192.168.56.103.57656 > 104.18.114.97.80: Flags [S], seq 2864717259, win 64240, options [mss 1460,sackOK,TS val 1169356395 ecr 0,nop,wscale 7], length 0 > 10:56:37.368625 enp0s3 Out IP 192.168.56.103.57656 > 104.18.114.97.80: Flags [S], seq 2864717259, win 64240, options [mss 1460,sackOK,TS val 1169358443 ecr 0,nop,wscale 7], length 0 > 10:56:40.726550 enp0s3 In IP 104.18.114.97.80 > 192.168.56.103.57656: Flags [S.], seq 64001, ack 2864717260, win 65535, options [mss 1460], length 0 > 10:56:40.726609 enp0s3 Out IP 192.168.56.103.57656 > 104.18.114.97.80: Flags [.], ack 1, win 64240, length 0 > 10:56:40.727387 enp0s3 Out IP 192.168.56.103.57656 > 104.18.114.97.80: Flags [P.], seq 1:77, ack 1, win 64240, length 76: HTTP: GET / HTTP/1.1 > 10:56:40.728146 enp0s3 In IP 104.18.114.97.80 > 192.168.56.103.57656: Flags [.], ack 77, win 65535, length 0 > 10:56:40.739934 enp0s3 In IP 104.18.114.97.80 > 192.168.56.103.57656: Flags [P.], seq 1:550, ack 77, win 65535, length 549: HTTP: HTTP/1.1 200 OK > 10:56:40.739977 enp0s3 Out IP 192.168.56.103.57656 > 104.18.114.97.80: Flags [.], ack 550, win 63691, length 0 > 10:56:40.742079 enp0s3 Out IP 192.168.56.103.57656 > 104.18.114.97.80: Flags [F.], seq 77, ack 550, win 63691, length 0 > 10:56:40.742822 enp0s3 In IP 104.18.114.97.80 > 192.168.56.103.57656: Flags [.], ack 78, win 65535, length 0 > 10:56:40.751004 enp0s3 In IP 104.18.114.97.80 > 192.168.56.103.57656: Flags [F.], seq 550, ack 78, win 65535, length 0 > 10:56:40.751038 enp0s3 Out IP 192.168.56.103.57656 > 104.18.114.97.80: Flags [.], ack 551, win 63691, length 0 > ^C > 13 packets captured > 17 packets received by filter > 0 packets dropped by kernel > > Here are some more info that you may be interested in: > > My uname -a output: > > Linux f38-test 6.4.7-200.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jul 27 20:01:18 UTC 2023 x86_64 GNU/Linux > > My curl -V output: > > curl 8.0.1 (x86_64-redhat-linux-gnu) libcurl/8.0.1 OpenSSL/3.0.9 zlib/1.2.13 brotli/1.0.9 libidn2/2.3.4 libpsl/0.21.2 (+libidn2/2.3.4) libssh/0.10.5/openssl/zlib nghttp2/1.52.0 > Release-Date: 2023-03-20 > Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp > Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets > > When --interface is specified, curl binds using SO_BINDTODEVICE when given an interface name, and bind(2) when given an IP address. > https://github.com/curl/curl/issues/11599#issuecomment-1667391636 > > My ifconfig output (enp0s3 is the NAT interface, enp0s8 is the host-only interface): > > enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 > inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255 > inet6 fe80::a00:27ff:fec5:2755 prefixlen 64 scopeid 0x20<link> > ether 08:00:27:c5:27:55 txqueuelen 1000 (Ethernet) > RX packets 20 bytes 2450 (2.3 KiB) > RX errors 0 dropped 0 overruns 0 frame 0 > TX packets 35 bytes 3150 (3.0 KiB) > TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 > > enp0s8: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 > inet 192.168.56.103 netmask 255.255.255.0 broadcast 192.168.56.255 > inet6 fe80::a00:27ff:fe2f:7c6 prefixlen 64 scopeid 0x20<link> > ether 08:00:27:2f:07:c6 txqueuelen 1000 (Ethernet) > RX packets 147 bytes 14330 (13.9 KiB) > RX errors 0 dropped 0 overruns 0 frame 0 > TX packets 256 bytes 33720 (32.9 KiB) > TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 > > lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 > inet 127.0.0.1 netmask 255.0.0.0 > inet6 ::1 prefixlen 128 scopeid 0x10<host> > loop txqueuelen 1000 (Local Loopback) > RX packets 0 bytes 0 (0.0 B) > RX errors 0 dropped 0 overruns 0 frame 0 > TX packets 0 bytes 0 (0.0 B) > TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 > > I will gladly provide more information should you need them, please let me know. > > Best regards, > Yat
Powered by blists - more mailing lists