Live data from Hacker News

RCE via ND6 Router Advertisements in FreeBSD

freebsd.org

61–70 of 85 posts

Re: RCE via ND6 Router Advertisements in FreeBSD

#61
post #34

Earlier quoted context omitted.

>So there is no way to tell if it is the real Starbucks WiFi or a hotspot some dude started on their laptop. Aka "unknown" or "public" Network....don't do that.

You don't use public networks? And when you connect to a non-public WiFi for the first time - how do you make sure it is the WiFi you think it is and not some dude who spun up a hotspot on their laptop?

Why does it matter? I mean I guess it did in this case but that is considered a top priority bug and quickly fixed.

I guess my point is the way the internet works is that your traffic goes through a number of unknown and possibly hostile actors on it's way to the final destination. Having a hostile actor presenting a spoofed wifi access point should not affect your security stance in any way. Either the connection works and you have the access you wanted or it does not. If you used secure protocols they are just as secure and if you used insecure protocols they are just as insecure.

Now having said that I will contradict myself, we are used to having our first hop be a high security trusted domain and tend to be a little sloppy there even when it is not. but still in general it does not matter. A secure connection is still a secure connection.

Re: RCE via ND6 Router Advertisements in FreeBSD

#62

Earlier quoted context omitted.

Not a joke. I knew they used to use a pile of janky shell scripts for their init system. I didn't know they still do. That's disappointing. And cesarb is correct - the issue isn't scripts; it's shell scripts, especially Bash and similar. Something like Deno/Typescript would be a decent option for example. Nushell is probably acceptable. Even Python - while a terrible choice - is a better option than shell scripts.

The issue is POSIX standardizing legacy stuff like shells, thereby tempting people to write "portable" software, leading these technologies to ossify and stick with us for half a century and counting. Someone comes along and builds something better but gets threatened for not following "the UNIX way".

This is a very good point. I wonder how hard it would be to get POSIX to standardise a scripting language that isn't awful.

Probably never going to happen. There is a dearth of good scripting languages, and I would imagine any POSIX committee is like 98% greybeard naysayers who think 70s Unix was the pinnacle of computing.

Re: RCE via ND6 Router Advertisements in FreeBSD

#63
post #19

Earlier quoted context omitted.

Sure, as long as the solution isn't to just bolt on another distinct DNS monolith. The root of the problem IMO is that no libc, AFAIK, exports an API for parsing, let alone composing or manipulating, resolv.conf formatted data. The solutions have either been the same as FreeBSD (openresolv, a portable implementation of Debian's resolvconf tool), or just freezing resolv.conf (notwithstanding occassional new libc featu…

> Sure, as long as the solution isn't to just bolt on another distinct DNS monolith Why not? And I don't mean this in tongue-in-cheek, but as a genuine interrogation: why not go the macOS/systemd route? DNS is a complex topic. Much more complex than people admit it is, and that can definitely not be expressed fully with resolv.conf. I do agree that it is too late to get rid of it (and was not my concern actually), bu…

> DNS is a complex topic. Much more complex than people admit it is, and that can definitely not be expressed fully with resolv.conf. I do agree that it is too late to get rid of it (and was not my concern actually), but it is too limited to be of actual use outside of the simple "I have a single DNS server with a single search domain".

resolv.conf is limited, but it's also been highly stable for decades, and it's sufficient if not ideal for controlling how getaddrinfo works (at least for on-the-wire requests), including controlling things like EDNS0, parallel requests, etc. Most if not all libc resolvers support things like parallel querying and other simple knobs which are configurable (if at all--see musl libc) through resolv.conf, demonstrating that it's expressive enough for most if not all common requirements shared among various client-side stub resolvers.

> And for more complex cases, simple integration with the network configuration daemon

But which one? Are you suggesting integration by way of loading it's configuration(s) (which puts us back at square 0), or by a modified query protocol, or by interfacing with the broader but even more diverse native configuration systems? None of the options seem remotely practical from the perspective of most open source projects, unless they're specifically targeting a single environment like Linux/systemd/resolvd. I don't see a viable pathway to make that happen. By contrast, embracing and hopefully improving resolv.conf as an integration point could be done piecemeal, environment by environment. The syntax is already effectively universal across systems, with the options directive providing most of the knobs. We could even make an initial push through POSIX by officially standardizing the syntax, which may even convince musl libc to make its resolver actually configurable.

> In the specific example of resolved, I'd argue it's even less work for applications, because they don't need to query multiple DNS servers at once (it'll handle it for them), don't need to try resolution with and without search domain, etc.

Yes, in most cases it's sufficient for userland applications to just make simple requests to the locally managed resolver service defined in resolv.conf. But the cases and projects needing more control over how they do their requests, using their own resolvers, only grows, especially with the proliferation of DNS schemes-see, e.g., the various recent HTTP-related DNS records which often require multiple queries and can benefit from parallel queries managed internally. A prime example is getaddrinfo itself, some implementations of which do parallel queries for A/AAAA lookups. Which brings us back to my main point: resolv.conf is the only common centralized point across almost all environment (Windows being the major exceptoin) for configuring basic DNS services.

I'm not arguing for improving resolv.conf integration as a way to replace local DNS services or their configuration. Just that for decades the staleness of resolv.conf has been a conspicuous and growing pain point from both a system configuration and userland integration perspective, and a little coordinated love & attention across the ecosystem, if only firmly committing to what's already there (especially for glibc and FreeBSD) as a reliable and more easily leveraged source of truth for code that needs it, would go a long way.

Re: RCE via ND6 Router Advertisements in FreeBSD

#64
post #15

Earlier quoted context omitted.

It's enabled by default, I was mostly talking about being in a lan with active ipv6, imo that's not that common.

IMHO you do not need "active" IPv6. Most LANs (unless you have some switch-level filtering that blocks router advertisements from "unauthorized" nodes) can transport such IPv6 packets. Then it just takes being connected to the LAN and being able to send an arbitrary ICMP6 packet (which probably means being root on the attacker machine, not a very high barrier I'd say).

You need working switch level filtering, many implementations can be bypassed / will never be fixed: https://blog.champtar.fr/VLAN0_LLC_SNAP/

Re: RCE via ND6 Router Advertisements in FreeBSD

#65
post #56
post #36

Earlier quoted context omitted.

With such confidence in your comment, I'm sure you can point out many successful precedents for such cases.

There's a federal mandate to implement IPv6 by... the end of this year. So in about 2-3 weeks.

Are you referring to the OMB IPv6 mandate? That only relates to federal networks, and even there its requiring only 80% adoption. It has zero relevance to normal commercial/private networks

Re: RCE via ND6 Router Advertisements in FreeBSD

#66
post #56
post #36

Earlier quoted context omitted.

With such confidence in your comment, I'm sure you can point out many successful precedents for such cases.

There's a federal mandate to implement IPv6 by... the end of this year. So in about 2-3 weeks.

For private ISPs? No, there isn't... please provide evidence for this.

Re: RCE via ND6 Router Advertisements in FreeBSD

#67
post #28

This actually makes me happy! I must be getting old! It truly is a bad one but I really appreciate Kevin Day for finding/reporting this and for all the volunteer work fixing this. All I had to do was "freebsd-update fetch install && reboot" on my systems and I could continue my day. Fleet management can be that easy for both pets and cattle. I do however feel for those who have deployed embedded systems. We can only…

> My HN addiction is now vindicated as I would probably not have noticed this RCE until after christmas. Always makes sense to subscribe to the security-announce mailing list of major dependencies (distro/vendor, openssh, openssl etc.) and oss-security.

Where major dependency is everything that even indirectly touches network. Doesn't really matter if the thing that gives everyone access to your systems is major or not.

Re: RCE via ND6 Router Advertisements in FreeBSD

#68

Earlier quoted context omitted.

It's amazing the number of people that thing shell scripts should be anything other than throwaway single-person hacks. They should probably go through their whole system and verify that there aren't more shell scripts being used, e.g. in the init system. Ideally a default distro would have zero shell scripts.

Unfortunately your joke has wooshed over quite a few heads but what you say is true. The shell should be one of the most reliable parts of your operating system. Why on earth would you NOT trust the primary interface of your OS? Makes no sense.

I'm not sure I follow you but it wasn't a joke. Shell scripts are notoriously error-prone. I absolutely do not trust shell script authors to get everything right.

Also the shell isn't even "the primary interface of your OS". For Linux that's the Linux ABI, or arguably libc.

Unless you meant "human interface", in which case also no - KDE is the primary interface of my OS.

Re: RCE via ND6 Router Advertisements in FreeBSD

#69
post #30

Having a shell script in the code path that processes router advertisements seems sub-optimal.

It's amazing the number of people that thing shell scripts should be anything other than throwaway single-person hacks. They should probably go through their whole system and verify that there aren't more shell scripts being used, e.g. in the init system. Ideally a default distro would have zero shell scripts.

You are being downvoted, but I agree with you.

I've always believed sh, csh, bash, etc, are very bad programming languages that require excessive efforts to learn how to write code in without unintentionally introducing bugs, including security holes.

Re: RCE via ND6 Router Advertisements in FreeBSD

#70

> resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed. The fix consists of implementing an XXX present since the code was added: /* * XXX validate that domain name only contains valid characters * for two reasons: 1) correctness, 2) we do not want to pass * possible malicious, unescaped characters like `` to a sc…

grep --include=*.{c,h} -rnw -B3 -A15 'XXX' ./ | claude -p 'Analyze each code snippet and pick the five most concerning, from a security perspective.'
Post reply on HN