Tails

#1 Updated by tailshark 2017-08-03 18:37:20

UPDATE:

I have confirmed the lookup is reproducible (at least here) if you do a “service tor restart” as root. The connections seem to come up quicker and more reliably show the bug.

I have also confirmed that my proposed patch seems to eliminate the problem.

#3 Updated by tailshark 2017-08-03 22:36:40

Just a thought on a way this could be exploited: The Tor exit could respond by saying, “Hi! I’m localhost.localdomain at port 0 and here’s your data!” —- If it’s commonly happening to Tails systems when connecting it could be a way to target Tails users specifically. Whatever app is making the requests would still have to be exploitable to take advantage of that but that’s still obviously way too close for comfort.

#4 Updated by tailshark 2017-08-04 11:45:58

I dug up where the /etc/hosts file is actually set in Tails. It looks like it’s here:
—————-
/lib/live/config/9000-hosts-file
—————-

Or the repo location of:
—————-
root/config/chroot_local-includes/lib/live/config/9000-hosts-file
—————-

The code there mentions the lack of an ipv6 entry to block ipv6 traffic. Is that accurate or would it lead to the opposite where ipv6 loopback traffic attempts to resolve with the DNS resolver rather than binding locally (leading to a potential ipv6 DNS Tor leak)?

#5 Updated by tailshark 2017-08-04 12:17:04

Answered my own question by testing an apt-get update. Apparently that is correct that ipv6 entry causes apt to fail.

#6 Updated by tailshark 2017-08-04 12:54:47

Proposed patch:
===
#!/bin/sh

1. Note: must run after /lib/live/config/0020-hostname since it
2. otherwise will overwrite any hosts file generated at build time with
3. a bloated one that also include the IPv6 host `::1 localhost`, which
4. can lead to IPv6 traffic, which we block, which may lead to stuff
5. breaking (for instance APTs tor+http transport).

echo “- setting up hosts file”
. /etc/live/config.d/hostname.conf

cat > /etc/hosts << EOF
127.0.0.1 localhost localhost.localdomain ${LIVE_HOSTNAME}
EOF
===

To file: /config/chroot_local-includes/lib/live/config/9000-hosts-file

#10 Updated by tailshark 2017-08-06 16:37:16

I’m new to the way things are done here and am trying to follow protocol. I have forked the repo and performed a patch there.

Patch details are as follows:

=

The following changes since commit da894deb09757313702b3c776fccbade5e2dcc57:

Updating trace file after uploading 3.0 to 3.1 IUK. (2017-08-06 12:43:54 +0200)

are available in the git repository at:

git@gitlab.com:tailshark/tails.git

for you to fetch changes up to d211341466643bd95a5abee50b5fd37b412317a7:

Fixed spelling mistake. (2017-08-06 16:09:04 +0000)

tailshark (2):
localhost.localdomain added to prevent loopback leaks to Tor circuits
Fixed spelling mistake.

config/chroot_local-includes/lib/live/config/9000-hosts-file | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)

=

#11 Updated by tailshark 2017-08-06 22:22:10

Branch at:
https://gitlab.com/tailshark/tails/commits/bugfix/13574-etc-hosts-localhost-localdomain-loopfix