From nobody Sat Aug 10 14:20:08 2024 X-Original-To: net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Wh2x43BDlz5Syws for ; Sat, 10 Aug 2024 14:20:08 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Wh2x41MjVz4Fwc for ; Sat, 10 Aug 2024 14:20:08 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1723299608; a=rsa-sha256; cv=none; b=D/KoimRoFZlhdBwJGLmiaA5DvCZdXptH2us1OaJkbWft7T6zmyUY74qbXZNxi86mZhTK/f R0MMhVwKzxht9FJzn6wsFXnmAy3GUKVTKfdn6RoCm9dTNuCIj7FpuODOdux5m86QZqsvrc OO/I+RAEkv2hQ2JTvUMQSzVKG0kEsJgOVg7E03zdp6mCi2bHFT/nZRAYUbfxJSQOV4JTb6 y2CD5+5SUFjxE4ap4Lzj+7bbmSy8Tzj/FBPSwqDay4qVkLpSU3wC+q9qWW+EYNRkQlgTyB 4bdiqVo/wOd2srCXwKQb7EIKA+7ke1DCl7/FbXb/sCMYwBJ9OTIxC2Ic7kCI4A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1723299608; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mmqkW8CdJ9IMMAtNxU+ycFMEcMd28O4cORTlUkUzmtg=; b=iVR8qid1VU7YtY/1oT+LIFq8hwp6FDFuPGOFCUTkoRplPNyr41ivCEMF2vpdInbxUCEPuR MMvNlhlCW0WXy01+t284wcvvAU2/HSC19bvXAKLO9BML7xzwABjnYcoYvlc0KT1iA03kD+ S55zGrJEZctxfeQ8p4W6+BQDcDOlcmn3TlpLSOFPlMlJsvj4S+7Y+B81n3QmKQ6SSKT24w mYShEqZMUMUFpauzJgCAO2EJGVnMXxO553THq1NgS9fCsGKIbF7flwgIJ8wc5tlg6a6QqZ Ghxvs93hRr9KPmjxkuUwVWC9HGnMgjNnB+wGAsCwWsJD01ULPIpWeBFBHZ/LLQ== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Wh2x410LKz13Y1 for ; Sat, 10 Aug 2024 14:20:08 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 47AEK8Uk023135 for ; Sat, 10 Aug 2024 14:20:08 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 47AEK8HC023133 for net@FreeBSD.org; Sat, 10 Aug 2024 14:20:08 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 280705] 0.0.0.0/32 is equivalent to 127.0.0.1/32, which may be considered a security flaw Date: Sat, 10 Aug 2024 14:20:08 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: jamie@catflap.org X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: net@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: cc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D280705 Jamie Landeg-Jones changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jamie@catflap.org --- Comment #9 from Jamie Landeg-Jones --- (In reply to Eirik Oeverby from comment #8) I tried this on 14.0-stable from March, and from my testing, it appears this does happen if you bind to 127.0.0.1, but not any other IP (even 127.0.0.2 aliased on lo0 didn't exhibit the behaviour) IE bind to 127.0.0.1 allows connections to 0.0.0.0, but binding to anything else doesn't. Still, I wouldn't have expected the bind to 127.0.0.1 to accept 0.0.0.0 --=20 You are receiving this mail because: You are the assignee for the bug.=