Adding uncompressed vendor and disclosure info

2021-01-27 00:50:40 -07:00
1 parent 78faf07a1e
commit 857296e8fb
@@ -0,0 +1,125 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Regarding "Inferring and hijacking VPN-tunneled TCP connections" - Jason A. Donenfeld</title><link rel="alternate" title="Atom feed" href="https://lore.kernel.org/wireguard/new.atom" type="application/atom+xml"><style>pre{white-space:pre-wrap}*{font-size:100%;font-family:monospace}</style><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/null.css" title="default"><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/216light.css" media="screen,(prefers-color-scheme:light)" title="216light"><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/216dark.css" media="screen,(prefers-color-scheme:dark)" title="216dark"></head><body data-new-gr-c-s-check-loaded="8.869.0" data-gr-ext-installed=""><form action="../"><pre><b>WireGuard Archive on lore.kernel.org</b>
+<input name="q" type="text"><input type="submit" value="search"> <a href="https://lore.kernel.org/wireguard/_/text/help">help</a> / <a href="https://lore.kernel.org/wireguard/_/text/color">color</a> / <a href="https://lore.kernel.org/wireguard/new.atom">Atom feed</a></pre></form><pre id="b">From: "Jason A. Donenfeld" &lt;Jason@zx2c4.com&gt;
+To: WireGuard mailing list &lt;wireguard@lists.zx2c4.com&gt;
+Subject: <a href="#r" id="t">Regarding "Inferring and hijacking VPN-tunneled TCP connections"</a>
+Date: Thu, 5 Dec 2019 20:13:18 +0100
+Message-ID: &lt;20191205191318.GA44156@zx2c4.com&gt; (<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/raw">raw</a>)
+
+Hey folks,
+
+William unembargoed his nice vuln this week: <a href="https://seclists.org/oss-sec/2019/q4/122">https://seclists.org/oss-sec/2019/q4/122</a>
+
+It appears to affect basically most common unix network stacks. This
+isn't a WireGuard vulnerability, but rather something in the routing
+table code and/or TCP code on affected operating systems. However, it
+does affect us, since WireGuard exists on those affected OSes.
+
+Some might chalk it up to just a configuration error, dismissing it as,
+"well, if you configure your networking stack poorly, bad things will
+happen," but I don't really buy that: the network setups affected by
+this vulnerability are pretty much the norm everywhere.
+
+And it turns out that we actually are in the business of properly
+configuring people's networking stacks. Specifically, the tools we ship
+come with the little bash script, wg-quick(8), which is a popular way of
+automating some common tasks. We've started looking at kernel-level
+mitigations within the Linux networking stack, but before those are
+ready, I thought it would be prudent to put some first-level defenses
+into wg-quick(8) itself.
+
+For that reason, since November, wg-quick(8) has added a few iptables(8)
+rules. I really dislike having wg-quick(8) grow any sort of dependency
+on iptables(8) (and eventually on nftables(8)), but at the moment, I
+don't see a viable alternative. Suggestions are welcome. In particular,
+we're adding a rule that is something like:
+
+&nbsp; &nbsp; iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP
+
+where wg0 is the WireGuard interface and 10.182.12.8 is the local IP of
+the interface.
+
+This says to drop all packets that are sent to that IP address that
+aren't coming from the WireGuard interface. And it's done very early in
+Netfilter, in the "raw" table. The researchers have confirmed that this
+mitigates the issue.
+
+Adding iptables(8) into wg-quick(8) has been predictably problematic,
+and it'll probably be at least another snapshot until we get things
+bug-free on all the different variations of the utility that distros
+ship, but we'll get there. In the meantime, I'd certainly appreciate
+patches to do the same with nftables(8), as well as some fresh thoughts
+on how to accomplish this same thing _without_ the firewall. (In the
+process of writing this email, for example, I had an idea regarding
+ip-rule(8) that might work out, but I haven't tried yet.) We also have
+some non-Linux operating systems to consider.
+
+
+Feedback welcome.
+
+Regards,
+Jason
+_______________________________________________
+WireGuard mailing list
+WireGuard@lists.zx2c4.com
+<a href="https://lists.zx2c4.com/mailman/listinfo/wireguard">https://lists.zx2c4.com/mailman/listinfo/wireguard</a>
+</pre><hr><pre><a href="https://lore.kernel.org/wireguard/db72ae85-4e68-1745-e11b-0fb81016358e@gmail.com/" rel="next">next</a>             <a href="#R">reply</a> <a href="https://lore.kernel.org/wireguard/">index</a>
+
+<b>Thread overview: </b>14+ messages / expand[<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/T/#u">flat</a>|<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t/#u">nested</a>]  <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t.mbox.gz">mbox.gz</a>  <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t.atom">Atom feed</a>  <a href="#b">top</a>
+<b>2019-12-05 19:13 <a id="r" href="#t">Jason A. Donenfeld [this message]</a></b>
+2019-12-05 19:50 ` <a href="https://lore.kernel.org/wireguard/db72ae85-4e68-1745-e11b-0fb81016358e@gmail.com/">Vasili Pupkin</a>
+2019-12-05 20:24   ` <a href="https://lore.kernel.org/wireguard/CAHmME9osDRPQvfYMexRcAhHdAb-x2PjD8Wnf+nrcHyX42ivmqA@mail.gmail.com/">Jason A. Donenfeld</a>
+2019-12-05 21:28     ` <a href="https://lore.kernel.org/wireguard/fdc450ad-f382-87d7-4c63-c31d595295df@gmail.com/">Vasili Pupkin</a>
+2019-12-06 15:18       ` <a href="https://lore.kernel.org/wireguard/CAHmME9pTt2MPH3gxks8S=3hVKS6P2XFkJd5eT7uivsoK7QPMJg@mail.gmail.com/">Jason A. Donenfeld</a>
+2019-12-06 17:21         ` <a href="https://lore.kernel.org/wireguard/6e0b3973-7874-275f-a9ec-cb7bf684cc7b@gmail.com/">Vasili Pupkin</a>
+2019-12-07 20:51         ` <a href="https://lore.kernel.org/wireguard/EA649C00-DEF2-464F-A5DF-9A81FA6FB5C4@lonnie.abelbeck.com/">Lonnie Abelbeck</a>
+2019-12-06 12:58     ` <a href="https://lore.kernel.org/wireguard/4e3e406b9511495b10964975b848cd686fa05719.camel@breakpointingbad.com/">William J. Tolley</a>
+2019-12-06 15:06     ` <a href="https://lore.kernel.org/wireguard/51usC7EJy_alaYnTOuLCvYhTzzcKrvAfq01j0Vfu5QVd6OGARQLdDDqQymloKWhWqkp81E09bpwjSRw5mnJDwg5fv8FuAVS-W0CYLuJlpRI=@protonmail.ch/">Jordan Glover</a>
+2019-12-06 15:08       ` <a href="https://lore.kernel.org/wireguard/CAHmME9qUWRO76NJrnO5iNoWuauvMT3kf+qM1bY49bVkcBFXY9g@mail.gmail.com/">Jason A. Donenfeld</a>
+2019-12-06 16:03         ` <a href="https://lore.kernel.org/wireguard/1bcf459c-4c08-33b2-19da-31cb62fd56a1@gmail.com/">Vasili Pupkin</a>
+2019-12-06 16:12           ` <a href="https://lore.kernel.org/wireguard/sZXjoRuWmvBHjZtlb28qeohg4R8BAHjCk5b-I2TWb5-ew1OZJBGYefxuSzTjFP7e5lESacVJMtp4fKIl7wyXJCI1iIznqnStW6OxG-P9YeQ=@protonmail.ch/">Jordan Glover</a>
+2019-12-06 17:06             ` <a href="https://lore.kernel.org/wireguard/860fe8c7-de2a-57c7-e69a-7ae9cbf263ae@gmail.com/">Vasili Pupkin</a>
+2019-12-05 20:10 ` <a href="https://lore.kernel.org/wireguard/eb8ebc51-aed6-fb83-9069-f699d430c4e5@trustiosity.com/">zrm</a>
+</pre><hr><pre id="R"><b>Reply instructions:</b>
+
+You may reply publicly to <a href="#t">this message</a> via plain-text email
+using any one of the following methods:
+
+* Save the following mbox file, import it into your mail client,
+  and reply-to-all from there: <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/raw">mbox</a>
+
+  Avoid top-posting and favor interleaved quoting:
+  <a href="https://en.wikipedia.org/wiki/Posting_style#Interleaved_style">https://en.wikipedia.org/wiki/Posting_style#Interleaved_style</a>
+
+* Reply using the <b>--to</b>, <b>--cc</b>, and <b>--in-reply-to</b>
+  switches of git-send-email(1):
+
+  git send-email \
+    --in-reply-to=20191205191318.GA44156@zx2c4.com \
+    --to=jason@zx2c4.com \
+    --cc=wireguard@lists.zx2c4.com \
+    /path/to/YOUR_REPLY
+
+  <a href="https://kernel.org/pub/software/scm/git/docs/git-send-email.html">https://kernel.org/pub/software/scm/git/docs/git-send-email.html</a>
+
+* If your mail client supports setting the <b>In-Reply-To</b> header
+  via mailto: links, try the <a href="mailto:jason%40zx2c4.com?In-Reply-To=%3C20191205191318.GA44156@zx2c4.com%3E&amp;Cc=wireguard%40lists.zx2c4.com&amp;Subject=Re%3A%20Regarding%20%22Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections%22">mailto: link</a>
+</pre>
+<hr><pre>WireGuard Archive on lore.kernel.org
+
+Archives are clonable:
+	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git
+
+	# If you have public-inbox 1.1+ installed, you may
+	# initialize and index your mirror using the following commands:
+	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
+		wireguard@lists.zx2c4.com
+	public-inbox-index wireguard
+
+Example <a href="https://lore.kernel.org/wireguard/_/text/config/raw">config snippet</a> for mirrors
+
+Newsgroup available over NNTP:
+	<a href="nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard">nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard</a>
+
+
+AGPL code for this site: git clone <a href="https://public-inbox.org/public-inbox.git">https://public-inbox.org/public-inbox.git</a></pre></body></html>
@@ -0,0 +1,51 @@
+/*
+ * CC0-1.0 <https://creativecommons.org/publicdomain/zero/1.0/legalcode>
+ * Dark color scheme using 216 web-safe colors, inspired
+ * somewhat by the default color scheme in mutt.
+ * It reduces eyestrain for me, and energy usage for all:
+ * https://en.wikipedia.org/wiki/Light-on-dark_color_scheme
+ */
+* { background:#000; color:#ccc }
+
+/*
+ * Underlined links add visual noise which make them hard-to-read.
+ * Use colors to make them stand out, instead.
+ */
+a { color:#69f; text-decoration:none }
+a:visited { color:#96f }
+
+/* quoted text in emails gets a different color */
+*.q { color:#09f }
+
+/*
+ * these may be used with cgit <https://git.zx2c4.com/cgit/>, too.
+ * (cgit uses <div>, public-inbox uses <span>)
+ */
+*.add { color:#0ff } /* diff post-image lines */
+*.del { color:#f0f } /* diff pre-image lines */
+*.head { color:#fff } /* diff header (metainformation) */
+*.hunk { color:#c93 } /* diff hunk-header */
+
+/*
+ * highlight 3.x colors (tested 3.18) for displaying blobs.
+ * This doesn't use most of the colors available, as I find too
+ * many colors overwhelming, so the default is commented out.
+ */
+.hl.num { color:#f30 } /* number */
+.hl.esc { color:#f0f } /* escape character */
+.hl.str { color:#f30 } /* string */
+.hl.ppc { color:#f0f } /* preprocessor */
+.hl.pps { color:#f30 } /* preprocessor string */
+.hl.slc { color:#09f } /* single-line comment */
+.hl.com { color:#09f } /* multi-line comment */
+/* .hl.opt { color:#ccc } */ /* operator */
+/* .hl.ipl { color:#ccc } */ /* interpolation */
+
+/* keyword groups kw[a-z] */
+.hl.kwa { color:#ff0 }
+.hl.kwb { color:#0f0 }
+.hl.kwc { color:#ff0 }
+/* .hl.kwd { color:#ccc } */
+
+/* line-number (unused by public-inbox) */
+/* .hl.lin { color:#ccc } */
@@ -0,0 +1,50 @@
+/*
+ * CC0-1.0 <https://creativecommons.org/publicdomain/zero/1.0/legalcode>
+ * Light color scheme using 216 web-safe colors.
+ * Suitable for print, and blinding people with brightness.
+ * Haphazardly thrown together because bright colors hurt my eyes
+ */
+* { background:#fff; color:#333 }
+
+/*
+ * Underlined links add visual noise which make them hard-to-read.
+ * Use colors to make them stand out, instead.
+ */
+a { color:#00f; text-decoration:none }
+a:visited { color:#808 }
+
+/* quoted text gets a different color */
+*.q { color:#006 }
+
+/*
+ * these may be used with cgit, too
+ * (cgit uses <div>, public-inbox uses <span>)
+ */
+*.add { color:#060 }
+*.del {color:#900 }
+*.head { color:#000 }
+*.hunk { color:#960 }
+
+/*
+ * highlight 3.x colors (tested 3.18) for displaying blobs.
+ * This doesn't use most of the colors available, as I find too
+ * many colors overwhelming, so the default is commented out.
+ */
+.hl.num { color:#f30 } /* number */
+.hl.esc { color:#f0f } /* escape character */
+.hl.str { color:#f30 } /* string */
+.hl.ppc { color:#c3c } /* preprocessor */
+.hl.pps { color:#f30 } /* preprocessor string */
+.hl.slc { color:#099 } /* single-line comment */
+.hl.com { color:#099 } /* multi-line comment */
+/* .hl.opt { color:#ccc } */ /* operator */
+/* .hl.ipl { color:#ccc } */ /* interpolation */
+
+/* keyword groups kw[a-z] */
+.hl.kwa { color:#f90 }
+.hl.kwb { color:#060 }
+.hl.kwc { color:#f90 }
+/* .hl.kwd { color:#ccc } */
+
+/* line-number (unused by public-inbox) */
+/* .hl.lin { color:#ccc } */