Hi everyone Does anybody knows which kind of address this is

Question

Hi everyone Does anybody knows which kind of address this is `00 02 08 10 60 00 00 00 00 00 00 00 00 00 88 82` address redacted I seed such addresses in bpf socket events remote address field and are not recognized with usual utilities like nc ping and so on

slevchenko · Answer

Hi < alessandrogario> I apologize for tagging you directly I ve noticed that you ve answered some bpf related questions If you have a spare moment could you please look into my question or advise someone might know Thanks in advance

alessandrogario · Answer

Hey < slevchenko> That looks like a bug can you verify that the address is correct by grouping those values every 2 bytes

slevchenko · Answer

I will Can you explain how to do it

alessandrogario · Answer

Sure You can just remove every odd ` ` character from the address

alessandrogario · Answer

So it becomes 0002 0810 6000 0000 0000 0000 0000 8882

alessandrogario · Answer

Now I don t know about endianness bytes may have to be swapped That would look like this `0200 1008 0060 0000 0000 0000 0000 8288`

alessandrogario · Answer

Finally I am not 100 sure about these rules but in theory fields that have only zeroes can be collapsed `0200 1008 0060 8288`

alessandrogario · Answer

This can probably applied to zeroes on the left too `200 1008 60 8288`

slevchenko · Answer

Now that does resemble valid IPv6

alessandrogario · Answer

were you able to verify that the IP address is correct

slevchenko · Answer

Unfortunatelly no I ve tried abut all variants I managed to get returned just ``` 88 Name or service not known```

slevchenko · Answer

I feel like I need some script to do all these transformations with no mistakes

slevchenko · Answer

Like swapping zeroes skipping octets filled with nothing but zeroes so on and so forth

slevchenko · Answer

Not sure if it helps but I ve noticed that mangled addresses come from containerized apps docker containers snaps Ubuntu snapcraft Flatpaks RH Flatpak

alessandrogario · Answer

I think it s just bad handling on all IPv6 addresses

alessandrogario · Answer

or are you thinking that those addresses are being mishandled and are not in fact IPv6

slevchenko · Answer

maybe but it gives a huge headache to our security team so I had to share it with someone form dev team at very least slightly smiling face

slevchenko · Answer

I think they are IPv6 but I don t know how they ended up messed up so bad

alessandrogario · Answer

if they have always been IPv6 they have been broken for a while I think

slevchenko · Answer

to me it looks like more just skipping zero filled octets since in this case address might look like `2008 `

alessandrogario · Answer

it s not corruption or uninintialized memory it s just that the logic to convert to string those addresses is wrong

slevchenko · Answer

Applications actually work so they definitely able to reach destinations it s rather related to how Osquery reflects them in query results

alessandrogario · Answer

yeah it s all in the toString method of IPv6 addresses

slevchenko · Answer

BTW to reproduce it one can try to use Thunderbird snap remote port 53 Microsoft Teams flatpak remote port 53 to name a few Unfortunately rest of apps are custom and naming them will not help

alessandrogario · Answer

I think a simple netcat on 1 should reproduce it easily

slevchenko · Answer

```00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01```

slevchenko · Answer

that s `nc 1 53`

slevchenko · Answer

So just as you said it s IPv6 conversion getting mangled

alessandrogario · Answer

Yeah so you can probably still query data that has been already collected

alessandrogario · Answer

until a fix is included in the stable release

slevchenko · Answer

Yes if I ll figure out how to convert it to readable form

slevchenko · Answer

it was easy with 1 but how to handle complex addresses which values we don t know beforehand

alessandrogario · Answer

i think the easiest way is to process this data from the log aggregator

alessandrogario · Answer

rather than trying to fix it with SQL

slevchenko · Answer

on our side osquery is used for anomaly detection and it works with ipv4

slevchenko · Answer

I guess we can wait Do you think this fix has any chances to make it into stable release

slevchenko · Answer

if that s considered a minor issue it would be also great to know we ll find a way to work around it one way or another

alessandrogario · Answer

We already have some additional fixes to BPF but I am not sure when they are going to be merged amp released

alessandrogario · Answer

bpf Improve socket event handling Add BPF support for CentOS 7 6 distributions with kernel 3 10 bpf process events Implement additional events

alessandrogario · Answer

It is definitely a bug so it will get fixed

slevchenko · Answer

Oh that s great Thank you Alessandro for your time and answers have a great day

alessandrogario · Answer

< slevchenko> I pushed a fix in this PR You can find the new tests here

slevchenko · Answer

That s great thanks for your efforts Alessandro