From owner-freebsd-net@FreeBSD.ORG  Tue Nov 27 14:21:56 2012
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 0A51A64B
 for <freebsd-net@freebsd.org>; Tue, 27 Nov 2012 14:21:56 +0000 (UTC)
 (envelope-from fernando@gont.com.ar)
Received: from web01.jbserver.net (web01.jbserver.net [93.186.182.34])
 by mx1.freebsd.org (Postfix) with ESMTP id BB92F8FC0C
 for <freebsd-net@freebsd.org>; Tue, 27 Nov 2012 14:21:54 +0000 (UTC)
Received: from 187-135-17-190.fibertel.com.ar ([190.17.135.187]
 helo=[192.168.1.113])
 by web01.jbserver.net with esmtpsa (TLSv1:DHE-RSA-CAMELLIA256-SHA:256)
 (Exim 4.80.1) (envelope-from <fernando@gont.com.ar>)
 id 1TdLgX-0002UX-F4; Tue, 27 Nov 2012 14:58:52 +0100
Message-ID: <50B4C714.6080206@gont.com.ar>
Date: Tue, 27 Nov 2012 10:58:44 -0300
From: Fernando Gont <fernando@gont.com.ar>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:17.0) Gecko/17.0 Thunderbird/17.0
MIME-Version: 1.0
To: FreeBSD Net <freebsd-net@freebsd.org>
Subject: VPN traffic leaks in IPv6/IPv4 dual-stack networks/hosts
X-Enigmail-Version: 1.4.6
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Nov 2012 14:21:56 -0000

Folks,

FYI. This is might affect FreeBSD users employing e.g. OpenVPN:
<http://tools.ietf.org/html/draft-gont-opsec-vpn-leakages>.

For a project such as OpenVPN, a (portable) fix might be non-trivial.
However, I guess FreeBSD might hook some PF rules when establishing the
VPN tunnel, such that e.g. all v6 traffic is filtered (yes, this is
certainly not the most desirable fix, but still probably better than
having your supposedly-secured traffic being sent in the clear).

P.S.: Please check the corresponding thread (same "Subject") on the
tech@openbsd.org mailing-list, since they have some patches for some of
these issues...

Thanks,
-- 
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@si6networks.com
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1