Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?

For example, with OpenBSD's pf:

block in  all # default deny
block out all
pass in  on dc0 from 10.0.0.0/8 to 10.1.1.1

Can IP source routing of TCP/IP packets over dc0 be used to circumnavigate (so to speak) the firewall rules and communicate with 10.1.1.1 from a network other than 10/8?

Even if possible, is such circumnavigation a viable or plausible attack if dc0 is public-facing? If so, can this be prevented?

share|improve this question
    
Do you mean using dc0 on the same machine as the pf or iptables? –  this.josh Jun 27 '11 at 5:17
    
@this.josh: Yes exactly, dc0 on the same machine as the firewall. –  Brian M. Hunt Jun 28 '11 at 13:39

2 Answers 2

up vote 2 down vote accepted

For incoming packets, packet filtering (call to pf_test on line 367) is done before option processing (call to ip_dooptions on line 384) in ip_input.c

For outgoing packets, routing (starting on line 170) is done before packet filtering (call to pf_test on line 691) in ip_output.c

So, if the packet filtering is working correctly, then no, source routing will not circumvent the firewall, because for incoming packets source routing is not applied until after filtering, and for outgoing packets filtering is done after source routing is applied.

share|improve this answer
    
Awesome; thanks for digging into that. –  Brian M. Hunt Jun 30 '11 at 1:11

I don't know specifically whether it can bypass these particular firewalls, but my superficial impression is that most firewalls block source routing, specifically because of these kinds of threats.

share|improve this answer
    
What do you mean by "disable"? Reject ingress packets that have any source routing? –  Brian M. Hunt Jun 26 '11 at 20:23
    
@Brian, yes, exactly. Thank you for helping me clarify. –  D.W. Jun 27 '11 at 6:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.