bind() on 127.0.0.1 in jail: bound to the outside address?

From: Xin LI (delphij_at_frontfree.net)
Date: 02/28/05

  • Next message: Jan Grant: "Re: bind() on 127.0.0.1 in jail: bound to the outside address?" 
    Date: Tue, 1 Mar 2005 00:25:48 +0800
To: freebsd-arch@FreeBSD.org, freebsd-security@FreeBSD.org

    Dear folks,

    It seems that doing bind() inside a jail (whose IP address is an outside
    address), will result in some wierd behavior, that the actual bind is
    done on the outside address.

    For example, binding to 127.0.0.1:6666 inside a jail addressed 192.168.1.1,
    will finally result in a bind to 192.168.1.1:6666. With this in mind,
    it is possible that some formerly secure configuration fail in jail
    environment.

    It seems that our implementation will forward every loopback connection
    to the outside address. A simple hack to work around this issue might
    be to modify the individual bind procedures to treat prison case with
    loopback address, but I'm not sure if a true solution can solve the
    issue with minimum code change and code complexity.

    Your ideas are highly appreciated!

    Cheers, 

    -- 
Xin LI <delphij frontfree net>	http://www.delphij.net/
See complete headers for GPG key and other information.

  • Next message: Jan Grant: "Re: bind() on 127.0.0.1 in jail: bound to the outside address?"

    Relevant Pages

    • right in search of drunk art
      ... Hassan's selection. ... I bind once, invent shyly, then release ... in conjunction with the plastic as for the jail. ...
      (sci.crypt)
    • bind() on 127.0.0.1 in jail: bound to the outside address?
      ... It seems that doing bind() inside a jail (whose IP address is an outside ... It seems that our implementation will forward every loopback connection ... issue with minimum code change and code complexity. ...
      (FreeBSD-Security)
    • Re: chroot versus jail for the name daemon
      ... > assuming named is running as user and group bind (rather than as root)? ... > 3) What happens if named is broken while in a jail, ... That means an attacker can set things up so ...
      (freebsd-questions)
    • Re: BIND inside a jail on FreeBSD 6.0
      ... devfs rule: ioctl DEVFSIO_RAPPLY: Operation not permitted ... (I realize that BIND already runs in a chroot'd environment, ... I tried mounting the devfs outside the jail to the jail's ...
      (freebsd-questions)
    • Re: INADDR_ANY bind in a multiip jail
      ... the pcb structure on jail bases. ... But is it also possible to bind in two jails the same port with inaddr_any? ...
      (freebsd-net)