patchlwIP - A Lightweight TCP/IP stack - Patches: patch #9170, ipv4/ipv6: restrict...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #9170: ipv4/ipv6: restrict loopback-destined traffic

Submitter:  David van Moolenbroek <dcvmoole>
Submitted:  Tue 22 Nov 2016 07:10:59 PM UTC
   
 
Category:  None Priority:  5 - Normal
Status:  Done Privacy:  Public
Assigned to:  goldsimon Open/Closed:  Closed
Planned Release:  None

Tue 22 Nov 2016 07:53:04 PM UTC, comment #1: 

Great, thanks for the patch!

Simon Goldschmidt <goldsimon>
Group administrator
Tue 22 Nov 2016 07:10:59 PM UTC, original submission:  

For your consideration. Commit message reproduced below. While the same check could be implemented with input hooks, I believe that from a "security by default" point of view it makes sense to implement this in lwIP itself. FWIW, I have verified (pre+post) that at least on my configuration, the patch indeed has the intended effect. As a bit of background, for one example (which admittedly I found with a google search) of why this is relevant for security, see https://googleprojectzero.blogspot.nl/2015/01/finding-and-exploiting-ntpd.html .

===

Generally speaking, packets with a loopback destination address - 127.0.0.1 for IPv4 and ::1 for IPv6 - should not be accepted on non-loopback interfaces.  For IPv4, this is implied by RFC 1122 Sec. 3.2.1.3.  For IPv6, it is mandated by RFC 4291 Sec. 2.5.3. Failure to perform this filtering may have security implications, as applications that bind sockets to loopback addresses may not expect that nodes on the local external network be able to produce traffic that will arrive at such sockets.

With this patch, lwIP drops packets that are sent to a loopback address but do not originate from the interface that has the loopback address assigned to it.  This approach works regardless of whether it is lwIP or the system using it that implements a loopback netif.  The only exception that must be made is for configurations that enable netif packet loopback but disable the lwIP loopback netif: in that case, loopback packets are routed across non-loopback netifs and would thus be lost by the new filter as well.

For IPv6, loopback-destined packets are also no longer forwarded; the IPv4 forwarding code already had a check for that.

As a small performance improvement, the IPv6 link-local/loopback address check is now performed only once per packet rather than repeatedly for every candidate netif.

David van Moolenbroek <dcvmoole>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by dcvmoole (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-11-22 goldsimon StatusNone Done
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2016-11-22 dcvmoole Attached File- Added 0001-ipv4-ipv6-restrict-loopback-destined-traffic.patch, #39047

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code