vpn-attacks/vendor-patches/WireGuard/Regarding 'Inferring and hi...

<html><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Regarding "Inferring and hijacking VPN-tunneled TCP connections" - Jason A. Donenfeld</title><link rel="alternate" title="Atom feed" href="https://lore.kernel.org/wireguard/new.atom" type="application/atom+xml"><style>pre{white-space:pre-wrap}*{font-size:100%;font-family:monospace}</style><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/null.css" title="default"><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/216light.css" media="screen,(prefers-color-scheme:light)" title="216light"><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/216dark.css" media="screen,(prefers-color-scheme:dark)" title="216dark"></head><body data-new-gr-c-s-check-loaded="8.869.0" data-gr-ext-installed=""><form action="../"><pre><b>WireGuard Archive on lore.kernel.org</b>
<input name="q" type="text"><input type="submit" value="search"> <a href="https://lore.kernel.org/wireguard/_/text/help">help</a> / <a href="https://lore.kernel.org/wireguard/_/text/color">color</a> / <a href="https://lore.kernel.org/wireguard/new.atom">Atom feed</a></pre></form><pre id="b">From: "Jason A. Donenfeld" &lt;Jason@zx2c4.com&gt;
To: WireGuard mailing list &lt;wireguard@lists.zx2c4.com&gt;
Subject: <a href="#r" id="t">Regarding "Inferring and hijacking VPN-tunneled TCP connections"</a>
Date: Thu, 5 Dec 2019 20:13:18 +0100
Message-ID: &lt;20191205191318.GA44156@zx2c4.com&gt; (<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/raw">raw</a>)

Hey folks,

William unembargoed his nice vuln this week: <a href="https://seclists.org/oss-sec/2019/q4/122">https://seclists.org/oss-sec/2019/q4/122</a>

It appears to affect basically most common unix network stacks. This
isn't a WireGuard vulnerability, but rather something in the routing
table code and/or TCP code on affected operating systems. However, it
does affect us, since WireGuard exists on those affected OSes.

Some might chalk it up to just a configuration error, dismissing it as,
"well, if you configure your networking stack poorly, bad things will
happen," but I don't really buy that: the network setups affected by
this vulnerability are pretty much the norm everywhere.

And it turns out that we actually are in the business of properly
configuring people's networking stacks. Specifically, the tools we ship
come with the little bash script, wg-quick(8), which is a popular way of
automating some common tasks. We've started looking at kernel-level
mitigations within the Linux networking stack, but before those are
ready, I thought it would be prudent to put some first-level defenses
into wg-quick(8) itself.

For that reason, since November, wg-quick(8) has added a few iptables(8)
rules. I really dislike having wg-quick(8) grow any sort of dependency
on iptables(8) (and eventually on nftables(8)), but at the moment, I
don't see a viable alternative. Suggestions are welcome. In particular,
we're adding a rule that is something like:

&nbsp; &nbsp; iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP

where wg0 is the WireGuard interface and 10.182.12.8 is the local IP of
the interface.

This says to drop all packets that are sent to that IP address that
aren't coming from the WireGuard interface. And it's done very early in
Netfilter, in the "raw" table. The researchers have confirmed that this
mitigates the issue.

Adding iptables(8) into wg-quick(8) has been predictably problematic,
and it'll probably be at least another snapshot until we get things
bug-free on all the different variations of the utility that distros
ship, but we'll get there. In the meantime, I'd certainly appreciate
patches to do the same with nftables(8), as well as some fresh thoughts
on how to accomplish this same thing _without_ the firewall. (In the
process of writing this email, for example, I had an idea regarding
ip-rule(8) that might work out, but I haven't tried yet.) We also have
some non-Linux operating systems to consider.


Feedback welcome.

Regards,
Jason
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
<a href="https://lists.zx2c4.com/mailman/listinfo/wireguard">https://lists.zx2c4.com/mailman/listinfo/wireguard</a>
</pre><hr><pre><a href="https://lore.kernel.org/wireguard/db72ae85-4e68-1745-e11b-0fb81016358e@gmail.com/" rel="next">next</a>             <a href="#R">reply</a> <a href="https://lore.kernel.org/wireguard/">index</a>

<b>Thread overview: </b>14+ messages / expand[<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/T/#u">flat</a>|<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t/#u">nested</a>]  <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t.mbox.gz">mbox.gz</a>  <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t.atom">Atom feed</a>  <a href="#b">top</a>
<b>2019-12-05 19:13 <a id="r" href="#t">Jason A. Donenfeld [this message]</a></b>
2019-12-05 19:50 ` <a href="https://lore.kernel.org/wireguard/db72ae85-4e68-1745-e11b-0fb81016358e@gmail.com/">Vasili Pupkin</a>
2019-12-05 20:24   ` <a href="https://lore.kernel.org/wireguard/CAHmME9osDRPQvfYMexRcAhHdAb-x2PjD8Wnf+nrcHyX42ivmqA@mail.gmail.com/">Jason A. Donenfeld</a>
2019-12-05 21:28     ` <a href="https://lore.kernel.org/wireguard/fdc450ad-f382-87d7-4c63-c31d595295df@gmail.com/">Vasili Pupkin</a>
2019-12-06 15:18       ` <a href="https://lore.kernel.org/wireguard/CAHmME9pTt2MPH3gxks8S=3hVKS6P2XFkJd5eT7uivsoK7QPMJg@mail.gmail.com/">Jason A. Donenfeld</a>
2019-12-06 17:21         ` <a href="https://lore.kernel.org/wireguard/6e0b3973-7874-275f-a9ec-cb7bf684cc7b@gmail.com/">Vasili Pupkin</a>
2019-12-07 20:51         ` <a href="https://lore.kernel.org/wireguard/EA649C00-DEF2-464F-A5DF-9A81FA6FB5C4@lonnie.abelbeck.com/">Lonnie Abelbeck</a>
2019-12-06 12:58     ` <a href="https://lore.kernel.org/wireguard/4e3e406b9511495b10964975b848cd686fa05719.camel@breakpointingbad.com/">William J. Tolley</a>
2019-12-06 15:06     ` <a href="https://lore.kernel.org/wireguard/51usC7EJy_alaYnTOuLCvYhTzzcKrvAfq01j0Vfu5QVd6OGARQLdDDqQymloKWhWqkp81E09bpwjSRw5mnJDwg5fv8FuAVS-W0CYLuJlpRI=@protonmail.ch/">Jordan Glover</a>
2019-12-06 15:08       ` <a href="https://lore.kernel.org/wireguard/CAHmME9qUWRO76NJrnO5iNoWuauvMT3kf+qM1bY49bVkcBFXY9g@mail.gmail.com/">Jason A. Donenfeld</a>
2019-12-06 16:03         ` <a href="https://lore.kernel.org/wireguard/1bcf459c-4c08-33b2-19da-31cb62fd56a1@gmail.com/">Vasili Pupkin</a>
2019-12-06 16:12           ` <a href="https://lore.kernel.org/wireguard/sZXjoRuWmvBHjZtlb28qeohg4R8BAHjCk5b-I2TWb5-ew1OZJBGYefxuSzTjFP7e5lESacVJMtp4fKIl7wyXJCI1iIznqnStW6OxG-P9YeQ=@protonmail.ch/">Jordan Glover</a>
2019-12-06 17:06             ` <a href="https://lore.kernel.org/wireguard/860fe8c7-de2a-57c7-e69a-7ae9cbf263ae@gmail.com/">Vasili Pupkin</a>
2019-12-05 20:10 ` <a href="https://lore.kernel.org/wireguard/eb8ebc51-aed6-fb83-9069-f699d430c4e5@trustiosity.com/">zrm</a>
</pre><hr><pre id="R"><b>Reply instructions:</b>

You may reply publicly to <a href="#t">this message</a> via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/raw">mbox</a>

  Avoid top-posting and favor interleaved quoting:
  <a href="https://en.wikipedia.org/wiki/Posting_style#Interleaved_style">https://en.wikipedia.org/wiki/Posting_style#Interleaved_style</a>

* Reply using the <b>--to</b>, <b>--cc</b>, and <b>--in-reply-to</b>
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191205191318.GA44156@zx2c4.com \
    --to=jason@zx2c4.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  <a href="https://kernel.org/pub/software/scm/git/docs/git-send-email.html">https://kernel.org/pub/software/scm/git/docs/git-send-email.html</a>

* If your mail client supports setting the <b>In-Reply-To</b> header
  via mailto: links, try the <a href="mailto:jason%40zx2c4.com?In-Reply-To=%3C20191205191318.GA44156@zx2c4.com%3E&amp;Cc=wireguard%40lists.zx2c4.com&amp;Subject=Re%3A%20Regarding%20%22Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections%22">mailto: link</a>
</pre>
<hr><pre>WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example <a href="https://lore.kernel.org/wireguard/_/text/config/raw">config snippet</a> for mirrors

Newsgroup available over NNTP:
	<a href="nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard">nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard</a>


AGPL code for this site: git clone <a href="https://public-inbox.org/public-inbox.git">https://public-inbox.org/public-inbox.git</a></pre></body></html>