125 lines
9.3 KiB
HTML
125 lines
9.3 KiB
HTML
<html><head>
|
|
<meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Regarding "Inferring and hijacking VPN-tunneled TCP connections" - Jason A. Donenfeld</title><link rel="alternate" title="Atom feed" href="https://lore.kernel.org/wireguard/new.atom" type="application/atom+xml"><style>pre{white-space:pre-wrap}*{font-size:100%;font-family:monospace}</style><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/null.css" title="default"><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/216light.css" media="screen,(prefers-color-scheme:light)" title="216light"><link type="text/css" rel="stylesheet" href="Regarding%20'Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections'%20-%20Jason%20A.%20Donenfeld_files/216dark.css" media="screen,(prefers-color-scheme:dark)" title="216dark"></head><body data-new-gr-c-s-check-loaded="8.869.0" data-gr-ext-installed=""><form action="../"><pre><b>WireGuard Archive on lore.kernel.org</b>
|
|
<input name="q" type="text"><input type="submit" value="search"> <a href="https://lore.kernel.org/wireguard/_/text/help">help</a> / <a href="https://lore.kernel.org/wireguard/_/text/color">color</a> / <a href="https://lore.kernel.org/wireguard/new.atom">Atom feed</a></pre></form><pre id="b">From: "Jason A. Donenfeld" <Jason@zx2c4.com>
|
|
To: WireGuard mailing list <wireguard@lists.zx2c4.com>
|
|
Subject: <a href="#r" id="t">Regarding "Inferring and hijacking VPN-tunneled TCP connections"</a>
|
|
Date: Thu, 5 Dec 2019 20:13:18 +0100
|
|
Message-ID: <20191205191318.GA44156@zx2c4.com> (<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/raw">raw</a>)
|
|
|
|
Hey folks,
|
|
|
|
William unembargoed his nice vuln this week: <a href="https://seclists.org/oss-sec/2019/q4/122">https://seclists.org/oss-sec/2019/q4/122</a>
|
|
|
|
It appears to affect basically most common unix network stacks. This
|
|
isn't a WireGuard vulnerability, but rather something in the routing
|
|
table code and/or TCP code on affected operating systems. However, it
|
|
does affect us, since WireGuard exists on those affected OSes.
|
|
|
|
Some might chalk it up to just a configuration error, dismissing it as,
|
|
"well, if you configure your networking stack poorly, bad things will
|
|
happen," but I don't really buy that: the network setups affected by
|
|
this vulnerability are pretty much the norm everywhere.
|
|
|
|
And it turns out that we actually are in the business of properly
|
|
configuring people's networking stacks. Specifically, the tools we ship
|
|
come with the little bash script, wg-quick(8), which is a popular way of
|
|
automating some common tasks. We've started looking at kernel-level
|
|
mitigations within the Linux networking stack, but before those are
|
|
ready, I thought it would be prudent to put some first-level defenses
|
|
into wg-quick(8) itself.
|
|
|
|
For that reason, since November, wg-quick(8) has added a few iptables(8)
|
|
rules. I really dislike having wg-quick(8) grow any sort of dependency
|
|
on iptables(8) (and eventually on nftables(8)), but at the moment, I
|
|
don't see a viable alternative. Suggestions are welcome. In particular,
|
|
we're adding a rule that is something like:
|
|
|
|
iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP
|
|
|
|
where wg0 is the WireGuard interface and 10.182.12.8 is the local IP of
|
|
the interface.
|
|
|
|
This says to drop all packets that are sent to that IP address that
|
|
aren't coming from the WireGuard interface. And it's done very early in
|
|
Netfilter, in the "raw" table. The researchers have confirmed that this
|
|
mitigates the issue.
|
|
|
|
Adding iptables(8) into wg-quick(8) has been predictably problematic,
|
|
and it'll probably be at least another snapshot until we get things
|
|
bug-free on all the different variations of the utility that distros
|
|
ship, but we'll get there. In the meantime, I'd certainly appreciate
|
|
patches to do the same with nftables(8), as well as some fresh thoughts
|
|
on how to accomplish this same thing _without_ the firewall. (In the
|
|
process of writing this email, for example, I had an idea regarding
|
|
ip-rule(8) that might work out, but I haven't tried yet.) We also have
|
|
some non-Linux operating systems to consider.
|
|
|
|
|
|
Feedback welcome.
|
|
|
|
Regards,
|
|
Jason
|
|
_______________________________________________
|
|
WireGuard mailing list
|
|
WireGuard@lists.zx2c4.com
|
|
<a href="https://lists.zx2c4.com/mailman/listinfo/wireguard">https://lists.zx2c4.com/mailman/listinfo/wireguard</a>
|
|
</pre><hr><pre><a href="https://lore.kernel.org/wireguard/db72ae85-4e68-1745-e11b-0fb81016358e@gmail.com/" rel="next">next</a> <a href="#R">reply</a> <a href="https://lore.kernel.org/wireguard/">index</a>
|
|
|
|
<b>Thread overview: </b>14+ messages / expand[<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/T/#u">flat</a>|<a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t/#u">nested</a>] <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t.mbox.gz">mbox.gz</a> <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/t.atom">Atom feed</a> <a href="#b">top</a>
|
|
<b>2019-12-05 19:13 <a id="r" href="#t">Jason A. Donenfeld [this message]</a></b>
|
|
2019-12-05 19:50 ` <a href="https://lore.kernel.org/wireguard/db72ae85-4e68-1745-e11b-0fb81016358e@gmail.com/">Vasili Pupkin</a>
|
|
2019-12-05 20:24 ` <a href="https://lore.kernel.org/wireguard/CAHmME9osDRPQvfYMexRcAhHdAb-x2PjD8Wnf+nrcHyX42ivmqA@mail.gmail.com/">Jason A. Donenfeld</a>
|
|
2019-12-05 21:28 ` <a href="https://lore.kernel.org/wireguard/fdc450ad-f382-87d7-4c63-c31d595295df@gmail.com/">Vasili Pupkin</a>
|
|
2019-12-06 15:18 ` <a href="https://lore.kernel.org/wireguard/CAHmME9pTt2MPH3gxks8S=3hVKS6P2XFkJd5eT7uivsoK7QPMJg@mail.gmail.com/">Jason A. Donenfeld</a>
|
|
2019-12-06 17:21 ` <a href="https://lore.kernel.org/wireguard/6e0b3973-7874-275f-a9ec-cb7bf684cc7b@gmail.com/">Vasili Pupkin</a>
|
|
2019-12-07 20:51 ` <a href="https://lore.kernel.org/wireguard/EA649C00-DEF2-464F-A5DF-9A81FA6FB5C4@lonnie.abelbeck.com/">Lonnie Abelbeck</a>
|
|
2019-12-06 12:58 ` <a href="https://lore.kernel.org/wireguard/4e3e406b9511495b10964975b848cd686fa05719.camel@breakpointingbad.com/">William J. Tolley</a>
|
|
2019-12-06 15:06 ` <a href="https://lore.kernel.org/wireguard/51usC7EJy_alaYnTOuLCvYhTzzcKrvAfq01j0Vfu5QVd6OGARQLdDDqQymloKWhWqkp81E09bpwjSRw5mnJDwg5fv8FuAVS-W0CYLuJlpRI=@protonmail.ch/">Jordan Glover</a>
|
|
2019-12-06 15:08 ` <a href="https://lore.kernel.org/wireguard/CAHmME9qUWRO76NJrnO5iNoWuauvMT3kf+qM1bY49bVkcBFXY9g@mail.gmail.com/">Jason A. Donenfeld</a>
|
|
2019-12-06 16:03 ` <a href="https://lore.kernel.org/wireguard/1bcf459c-4c08-33b2-19da-31cb62fd56a1@gmail.com/">Vasili Pupkin</a>
|
|
2019-12-06 16:12 ` <a href="https://lore.kernel.org/wireguard/sZXjoRuWmvBHjZtlb28qeohg4R8BAHjCk5b-I2TWb5-ew1OZJBGYefxuSzTjFP7e5lESacVJMtp4fKIl7wyXJCI1iIznqnStW6OxG-P9YeQ=@protonmail.ch/">Jordan Glover</a>
|
|
2019-12-06 17:06 ` <a href="https://lore.kernel.org/wireguard/860fe8c7-de2a-57c7-e69a-7ae9cbf263ae@gmail.com/">Vasili Pupkin</a>
|
|
2019-12-05 20:10 ` <a href="https://lore.kernel.org/wireguard/eb8ebc51-aed6-fb83-9069-f699d430c4e5@trustiosity.com/">zrm</a>
|
|
</pre><hr><pre id="R"><b>Reply instructions:</b>
|
|
|
|
You may reply publicly to <a href="#t">this message</a> via plain-text email
|
|
using any one of the following methods:
|
|
|
|
* Save the following mbox file, import it into your mail client,
|
|
and reply-to-all from there: <a href="https://lore.kernel.org/wireguard/20191205191318.GA44156@zx2c4.com/raw">mbox</a>
|
|
|
|
Avoid top-posting and favor interleaved quoting:
|
|
<a href="https://en.wikipedia.org/wiki/Posting_style#Interleaved_style">https://en.wikipedia.org/wiki/Posting_style#Interleaved_style</a>
|
|
|
|
* Reply using the <b>--to</b>, <b>--cc</b>, and <b>--in-reply-to</b>
|
|
switches of git-send-email(1):
|
|
|
|
git send-email \
|
|
--in-reply-to=20191205191318.GA44156@zx2c4.com \
|
|
--to=jason@zx2c4.com \
|
|
--cc=wireguard@lists.zx2c4.com \
|
|
/path/to/YOUR_REPLY
|
|
|
|
<a href="https://kernel.org/pub/software/scm/git/docs/git-send-email.html">https://kernel.org/pub/software/scm/git/docs/git-send-email.html</a>
|
|
|
|
* If your mail client supports setting the <b>In-Reply-To</b> header
|
|
via mailto: links, try the <a href="mailto:jason%40zx2c4.com?In-Reply-To=%3C20191205191318.GA44156@zx2c4.com%3E&Cc=wireguard%40lists.zx2c4.com&Subject=Re%3A%20Regarding%20%22Inferring%20and%20hijacking%20VPN-tunneled%20TCP%20connections%22">mailto: link</a>
|
|
</pre>
|
|
<hr><pre>WireGuard Archive on lore.kernel.org
|
|
|
|
Archives are clonable:
|
|
git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git
|
|
|
|
# If you have public-inbox 1.1+ installed, you may
|
|
# initialize and index your mirror using the following commands:
|
|
public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
|
|
wireguard@lists.zx2c4.com
|
|
public-inbox-index wireguard
|
|
|
|
Example <a href="https://lore.kernel.org/wireguard/_/text/config/raw">config snippet</a> for mirrors
|
|
|
|
Newsgroup available over NNTP:
|
|
<a href="nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard">nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard</a>
|
|
|
|
|
|
AGPL code for this site: git clone <a href="https://public-inbox.org/public-inbox.git">https://public-inbox.org/public-inbox.git</a></pre></body></html> |