I'm still confused, but in any case, there's nothing stopping "miou" from impersonating "apeliote"'s subnets in your case, unless you use StrictSubnets.
Here's the easiest way to do the spoofing: In miou's own node file (on the miou machine itself), add apeliote's subnets with a Weight smaller than 10 (which is the default), so that it overrides them. For example, if apeliote has a single 1.2.3.0/24 subnet, then add the following to miou's own node file (on the miou machine, not on Neptune): Subnet = 1.2.3.0/24#1 Alternatively, you can do this without messing with the weights simply by declaring two more specific subnets: Subnet = 1.2.3.0/25 Subnet = 1.2.3.128/25 If you do this, then Neptune will happily accept the spoofed subnets, and apeliote will become unreachable while miou intercepts all communications. This is the primary reason why it's a very bad idea to let untrusted nodes join a tinc network. The only way to defend against this type of attack is to use StrictSubnets. On 4 May 2015 at 21:13, err404 <[email protected]> wrote: > On 05/04/2015 10:01 PM, Etienne Dechamps wrote: >> On 4 May 2015 at 20:53, Anne-Gwenn Kettunen <[email protected]> wrote: >>> We started to take a look about that, and apparently, it seems that the IP >>> in the public key is taken into account when a client connects to a gateway. >>> Spoofing at that level doesn't seem easy, because the IP address seems to be >>> part of the authentication process. >> >> I'm having trouble understanding what you mean by "gateway", >> "authentication process" and "IP address" especially when you say it's >> part of the "public key" (it's not). >> >> Can you clarify? I am pretty sure tinc doesn't use IP addresses in any >> of its security mechanisms, except when StrictSubnets is enabled. >> > > I tested with two node "miou" and "apeliote" > they have a connectTo. and public key from "Neptune". > > "Neptune" node have their public key also. (and all node can play together) > > /etc/tinc/tinclan/host/miou contain a subnet with IP and public key from > "miou" > /etc/tinc/tinclan/host/apeliote contain a subnet with IP and public key from > "apeliote" > > If IP from miou is changed with IP from apeliote, "miou" can not connect to > "Neptune" > even miou have apeliote's IP. > > ok, this is not the best spoofing tentative :p > > > _______________________________________________ > tinc mailing list > [email protected] > http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc > _______________________________________________ tinc mailing list [email protected] http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
