lkml.org 
[lkml]   [2002]   [Mar]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Network Security hole (was -> Re: arp bug )

    Hello,

    On Sat, 2 Mar 2002 erich@uruk.org wrote:

    > [My apologies for getting into this thread rather late, but I just
    > came across this on a network I'm working with which is all on the
    > same switch/VLAN... I had 2 network cards per machine and was
    > puzzled why traffic destined for one interface went to the other]

    If another host (spoofer) on the LAN is faster all
    your devices lose the race.

    > I.e. the machine still may be accepting traffic destined for one
    > interface on another, even though it won't *advertise* that fact
    > any more.

    You mix two different issues:

    1. ARP replying for same request through many devices

    2. ARP probes advertising same source IP through many devices

    Your statement is related to (1). There are some golden
    rules on this issue:

    - use rp_filter protection for all your external interface

    - use different "external" interfaces for the different external
    networks if you want to differentiate the traffic from/to them
    and protect them with rp_filter

    - use rp_filter protection for all "internal" interfaces
    attached to same medium (hub) as the "external" interfaces

    - no need to use rp_filter protection for the other "internal"
    interfaces, it is recommended, though

    - if you want to differentiate traffic by protocol or ports
    use firewall rules (IPSec, stateful conntracking, etc)

    As for (2) I don't see how this can be remotely
    exploited but my opinion is that it should be fixed.
    The current behavior is still valid: if you can talk
    from one local IP to some remote IP through one device
    then you should allow the reverse traffic to work. With
    my fix we just want to reduce the set of the local IPs
    that can be used for ARP announcement. It is only a local
    problem - ARP uses scope link routes. Make sure (1) does
    not lead to problems caused remotely.

    > Am I the only one that saw this kind of scary hole?

    The users prefer protection provided from firewall
    rules, even for address spoofing, a matter of taste.

    Regards

    --
    Julian Anastasov <ja@ssi.bg>

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:21    [W:5.657 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site