Re: [rtcweb] Please require user consent for data channels

[Simon Perreault <[e-mail]>]

Le 2015-07-20 15:26, Simon Perreault a écrit :
>> I can think of some financial institutions who’s IDSs will go off when packets
>> > to public external addresses start turning up on internal LANS . (hopefully they 
>> > will get dropped at the egress router, but by then the IDS will have paged someone).
> But that's not going to happen unless there's a route. I think there
> could be a misunderstanding here. For example, if there's a VPN with a
> 10.0.0.0/8 route but no default route, the ICE client will *not* send a
> request to a TURN server listening on 192.0.2.1 over the VPN interface.
> That would make no sense whatsoever.

Just to be sure I am not going crazy, I just wrote this test:

> #include <sys/socket.h>
> #include <sys/types.h>
> 
> #include <netinet/in.h>
> #include <string.h>
> 
> int
> main(int argc, char *argv[])
> {
>         int                      s;
>         struct sockaddr_in       sin;
>         char                     foo[] = "bar";
> 
>         s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
> 
>         sin.sin_family = AF_INET;
>         sin.sin_addr.s_addr = inet_addr("192.168.2.128");
>         sin.sin_port = htons(1234);
>         memset(&sin.sin_zero, 0, sizeof(sin.sin_zero));
>         bind(s, (struct sockaddr *)&sin, sizeof(sin));
> 
>         sin.sin_family = AF_INET;
>         sin.sin_addr.s_addr = inet_addr("192.168.2.200");
>         sin.sin_port = htons(53);
>         memset(&sin.sin_zero, 0, sizeof(sin.sin_zero));
>         sendto(s, foo, sizeof(foo), 0, (struct sockaddr *)&sin, sizeof(sin));
> 
>         sin.sin_family = AF_INET;
>         sin.sin_addr.s_addr = inet_addr("8.8.8.8");
>         sin.sin_port = htons(53);
>         memset(&sin.sin_zero, 0, sizeof(sin.sin_zero));
>         sendto(s, foo, sizeof(foo), 0, (struct sockaddr *)&sin, sizeof(sin));
> 
>         return (0);
> }

I ran it on this system:

> sperreault@debian:~$ ip a
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 scope host lo
>     inet6 ::1/128 scope host
>        valid_lft forever preferred_lft forever
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
>     link/ether 00:0c:29:66:b9:2c brd ff:ff:ff:ff:ff:ff
>     inet 192.168.2.128/24 brd 192.168.2.255 scope global eth0
>     inet6 fe80::20c:29ff:fe66:b92c/64 scope link
>        valid_lft forever preferred_lft forever
> sperreault@debian:~$ ip r
> 192.168.2.0/24 dev eth0  proto kernel  scope link  src 192.168.2.128
> sperreault@debian:~$

Strace's output is:

> bind(3, {sa_family=AF_INET, sin_port=htons(1234), sin_addr=inet_addr("192.168.2.128")}, 16) = 0
> sendto(3, "bar\0", 4, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.2.200")}, 16) = 4
> sendto(3, "bar\0", 4, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}, 16) = -1 ENETUNREACH (Network is unreachable)

This confirms that bind() does not override the routing table.

Simon