Subject: Re: [vserver] network issues with lo interface
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Thu, 26 Feb 2009 14:02:02 +0100

On Thu, Feb 26, 2009 at 10:11:11AM +1300, Corin Langosch wrote:
> On 26.02.2009 07:03, Herbert Poetzl wrote:
> > On Mon, Feb 23, 2009 at 10:45:52AM +1300, Corin Langosch wrote:

> >> It seems the "real" IP of the guest is chosen this time to connect to
> >> the local interface, not even a random 127.0.0.1/8 one.

> > so?

> Well my firewall rule "-s 127.0.0.0/8 <http://127.0.0.0/8>" didn't work
> anymore. And I found it quite weierd to see internal traffic originating
> from an external interface.

you have external and internal interfaces?

the IPs assigned to the host (and that includes all
functional IPs assigned to guests) are host local,
so they are by definition local IPs

> >> $IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT is safe and
> >> doesn't expose any security flaws between different vserver guests?

> > what kind of 'security flaws' do you have to be exposed?

> If I unterstand correctly and the traffic is only remapped and
> not isolated, a guest can simply connect to another guest's local
> interface by guessing (scanning) it's current local ip address?

nope, as the connect would _also_ be rewritten to
the assigned lback IP, and thus never will reach
the 'other' guest (assuming you mean the 128.
net with 'local interface')

> Obviously this would be a real security flaw, as many daemons and
> poeple binding stuff to 127.0.0.1 expect it to be a secure address and
> don't have extra auth stuff in the protocol implemented or activated.

unfortunately a lot of software _has_ special checks
for 127. or even 127.0.0.1, which was the reason for
doing this 'isolation' in the first place :)

> What's the best firewall rule to protect against this? I mean ex. 
> "-s > 127.1.2.3 -d 127.1.2.3" won't work because the traffic not 
> always originates from 127.1.2.3, but possible from any interface 
> in the guest (or whole host?)?

depends on what you do, source address selection is
a little tricky and the implementation varies across
the kernels and patch versions.

note: testing with 'ping' is a double-edged sword -
as it crafts the packets manually, it might use a
different source IP than you expect, that is, why it
has the -I option...

> BTW: Thank's so far for all the other tipps. I updated my vserver
> config and the sysctl stuff and didn't have any problems anymore.

great!

best,
Herbert

> Corin
>