Saturday, August 15, 2009

Confusing ifconfig with funky DNS setups

Have you ever mistyped a option for ifconfig? I'm sure you did! What happened?

Most of the time, you will get a error message like "bad value" or something. In my case the ip address of the interface got set to a strange value. I was really surprised and thought, that I found a bug since i was testing a diff from Henning for ifconfig on OpenBSD at this moment anyway. On a lazy afternoon a few day later, I tried to find the bug together with Pedro. We were laughing our asses off, when we figured out what happened:

The second argument of ifconfig (the first one after the interface) is tested if it is a option. If it is not, it is tested if it is a valid IP address and sets the IP on this interface. If is is not, guess what, it does a DNS query for this string! Normally the DNS server will not give a valid answer and the error message is printed.

Yes, just try it:

# ifconfig em0 www.google.com

will set the IP of google on your interface.

In my case, the resolver added my domain to the string and asked the DNS server of my domain hoster. They have a wildcard for my domain pointing to their website, so I got their IP everytime I mistyped a option.

This is definitely one more reason why wildcard DNS records are bad bad bad!

I don't know why ifconfig is doing this anyway. Maybe it was some poor man's DHCP in the old days?

That is just hilarious! It would be even more funny, when ifconfig would do the DNS query before scanning internally for options. In this case it would be possible for anybody controlling (or spoofing) the DNS server to change the IP of a interface. Just think about up.victimsdomain.net! Fortunately OpenBSD does it in the right order. I'm not aware of systems doing it wrong, but if you know one, please send me a mail.