Date: Mon, 19 May 2025 10:34:56 +0200 From: Kristof Provost <kp@FreeBSD.org> To: Shawn Webb <shawn.webb@hardenedbsd.org> Cc: Mitchell Horne <mhorne@freebsd.org>, Lexi Winter <ivy@freebsd.org>, src-committers@freebsd.org, dev-commits-src-all@freebsd.org, dev-commits-src-main@freebsd.org Subject: Re: git: b61850c4e6f6 - main - bridge(4): default net.link.bridge.member_ifaddrs to false Message-ID: <FBBF4097-FC6E-4B9B-B6F6-D7735CE2EAEF@FreeBSD.org> In-Reply-To: <ujaozh75ualvll62xplvsixea45txr5ms34s3oqgnqe3g4fzcj@rkbwovdqwx57> References: <202505150004.54F04FhR046897@gitrepo.freebsd.org> <d839f137-b43b-416b-968f-439301f0a5c6@freebsd.org> <C5E86940-9C1B-428B-980B-693FE92E7AED@FreeBSD.org> <94441836-bb03-4c80-b603-aaa2997c4d29@freebsd.org> <ujaozh75ualvll62xplvsixea45txr5ms34s3oqgnqe3g4fzcj@rkbwovdqwx57>
next in thread | previous in thread | raw e-mail | index | archive | help
On 18 May 2025, at 22:39, Shawn Webb wrote: > I wonder if there is any security difference between DHCP on the > physical interface versus the bridge. Having the bridge grab an IP via > DHCP (or IPv6 SLAAC/DHCPv6) means that VMs much be trusted. If a VM is > compromised, a threat actor could redirect traffic on the host by > running their own DHCP service in the compromised VM. > > The question I have, though, is: is this an issue when the physical > interface is used instead of the bridge for grabbing a dynamic IP? > > So, I guess I'm asking, is there any security difference between the > following two configs: > > =3D=3D=3D=3D BEGIN CONFIG 1 =3D=3D=3D=3D > ifconfig_re0=3D"DHCP" > cloned_interfaces=3D"bridge0 tap0" > ifconfig_bridge0=3D"addm re0 addm tap0" > =3D=3D=3D=3D END CONFIG 1 =3D=3D=3D=3D > > =3D=3D=3D=3D BEGIN CONFIG 2 =3D=3D=3D=3D > ifconfig_re0=3D"up" > cloned_interfaces=3D"bridge0 tap0" > ifconfig_bridge0=3D"DHCP addm re0 addm tap0" > synchronous_dhclient=3D"YES" > =3D=3D=3D=3D END CONFIG 2 =3D=3D=3D=3D > I=E2=80=99ve not actually tested it, but given that ether_output() (which= is going to be the ifp->if_output for most interfaces) does this: https:= //cgit.freebsd.org/src/tree/sys/net/if_ethersubr.c#n417 (i.e. it outputs via if_bridge=E2=80=99s code rather than directly) I bel= ieve this doesn=E2=80=99t make any difference at all. =E2=80=94 Kristof
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FBBF4097-FC6E-4B9B-B6F6-D7735CE2EAEF>