Linux rtnetlink parsing assigns peer address as interface IP on point-to-point links

[0x-0ddc0de]

Brief description

For point-to-point links (eg VPN), when scapy populates conf.ifaces with interface IP addresses, it uses the peer address rather than the local interface address; thus calls such as get_if_addr will give a wrong IP.

Scapy version

2.6.1

Python version

3.11.0

Operating system

Ubuntu 24.04.2

Additional environment information

I enabled VPN.

How to reproduce

1. get on a VPN. It will create a virtual interface like tun0, which is a point-to-point link.
2. the command ip a will show something like

tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1350 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 100.64.100.6 peer 100.64.100.5/32 scope global tun0

indicating that the tunnel has a local interface IP address 100.64.100.6 and peer address 100.64.100.5.
3. scapy's conf.ifaces will erroneously show the peer address 100.64.100.5 as the tun0 interface IP address. Similarly, calls like get_if_addr('tun0') will give that incorrect address.

Actual result

>>> conf.ifaces
Source  Index  Name    MAC                    IPv4           IPv6                                   
sys     4      tun0    00:00:00:00:00:00      100.64.100.5   fe80::2803:ec2d:7b7d:cdf5   

>>> get_if_addr('tun0')
'100.64.100.5'

In contrast:

$ ip a

4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1350 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 100.64.100.6 peer 100.64.100.5/32 scope global tun0
       valid_lft forever preferred_lft forever

Expected result

>>> conf.ifaces
Source  Index  Name    MAC                    IPv4           IPv6                                   
sys     4      tun0    00:00:00:00:00:00      100.64.100.6   fe80::2803:ec2d:7b7d:cdf5   

>>> get_if_addr('tun0')
'100.64.100.6'

Related resources

No response

[gpotter2]

Hi & thanks for the report.
Could you share the output of

from scapy.arch.linux.rtnetlink import _sr1_rtrequest
results = _sr1_rtrequest(
        rtmsghdr(
            nlmsg_type="RTM_GETADDR",
            nlmsg_flags="NLM_F_REQUEST+NLM_F_ROOT+NLM_F_MATCH",
            nlmsg_seq=int(time.time()),
        )
        / ifaddrmsg(
            ifa_family=af_family,
            data=[],
        )
    )
print(repr(results))

Thanks

[0x-0ddc0de]

Hi & thanks for the report. Could you share the output of

from scapy.arch.linux.rtnetlink import _sr1_rtrequest
results = _sr1_rtrequest(
        rtmsghdr(
            nlmsg_type="RTM_GETADDR",
            nlmsg_flags="NLM_F_REQUEST+NLM_F_ROOT+NLM_F_MATCH",
            nlmsg_seq=int(time.time()),
        )
        / ifaddrmsg(
            ifa_family=af_family,
            data=[],
        )
    )
print(repr(results))

Thanks

This is the output:

[<rtmsghdr nlmsg_len=76 nlmsg_type=RTM_NEWADDR nlmsg_flags=NLM_F_MULTI nlmsg_seq=1765640649 nlmsg_pid=12958 |<ifaddrmsg ifa_family=AF_INET ifa_prefixlen=8 ifa_flags=IFA_F_PERMANENT ifa_scope=254 ifa_index=1 data=[<ifaddrmsg_rtattr rta_len=8 rta_type=IFA_ADDRESS rta_data=127.0.0.1 |>, <ifaddrmsg_rtattr rta_len=8 rta_type=IFA_LOCAL rta_data=127.0.0.1 |>, <ifaddrmsg_rtattr rta_len=7 rta_type=IFA_LABEL rta_data=b'lo\x00' |>, <ifaddrmsg_rtattr rta_len=8 rta_type=IFA_FLAGS rta_data=80000000 |>, <ifaddrmsg_rtattr rta_len=20 rta_type=IFA_CACHEINFO rta_data=ffffffffffffffff9f0000009f000000 |>] |>>, <rtmsghdr nlmsg_len=88 nlmsg_type=RTM_NEWADDR nlmsg_flags=NLM_F_MULTI nlmsg_seq=1765640649 nlmsg_pid=12958 |<ifaddrmsg ifa_family=AF_INET ifa_prefixlen=24 ifa_flags= ifa_scope=0 ifa_index=3 data=[<ifaddrmsg_rtattr rta_len=8 rta_type=IFA_ADDRESS rta_data=192.168.0.205 |>, <ifaddrmsg_rtattr rta_len=8 rta_type=IFA_LOCAL rta_data=192.168.0.205 |>, <ifaddrmsg_rtattr rta_len=8 rta_type=IFA_BROADCAST rta_data=192.168.0.255 |>, <ifaddrmsg_rtattr rta_len=9 rta_type=IFA_LABEL rta_data=b'wlo1\x00' |>, <ifaddrmsg_rtattr rta_len=8 rta_type=IFA_FLAGS rta_data=00020000 |>, <ifaddrmsg_rtattr rta_len=20 rta_type=IFA_CACHEINFO rta_data=690b0000690b00003403000045c20200 |>] |>>, <rtmsghdr nlmsg_len=80 nlmsg_type=RTM_NEWADDR nlmsg_flags=NLM_F_MULTI nlmsg_seq=1765640649 nlmsg_pid=12958 |<ifaddrmsg ifa_family=AF_INET ifa_prefixlen=32 ifa_flags=IFA_F_PERMANENT ifa_scope=0 ifa_index=4 data=[<ifaddrmsg_rtattr rta_len=8 rta_type=IFA_ADDRESS rta_data=100.64.100.5 |>, <ifaddrmsg_rtattr rta_len=8 rta_type=IFA_LOCAL rta_data=100.64.100.6 |>, <ifaddrmsg_rtattr rta_len=9 rta_type=IFA_LABEL rta_data=b'tun0\x00' |>, <ifaddrmsg_rtattr rta_len=8 rta_type=IFA_FLAGS rta_data=80000000 |>, <ifaddrmsg_rtattr rta_len=20 rta_type=IFA_CACHEINFO rta_data=ffffffffffffffffcb970000cb970000 |>] |>>]

I've been able to fix the bug by modifying scapy/arch/linux/rtnetlink.py by adding a new check for if attr.rta_type == 0x02: # IFA_LOCAL and using the associated attr.rta_data.

Looking at the if_addr.h header, I see the following relevant advice:

 * Important comment:
 * IFA_ADDRESS is prefix address, rather than local interface address.
 * It makes no difference for normally configured broadcast interfaces,
 * but for point-to-point IFA_ADDRESS is DESTINATION address,
 * local address is supplied in IFA_LOCAL attribute.

I can open a PR to fix it.

[gpotter2]

Thanks for the analysis !

can open a PR to fix it.

Sure that would be great. Thanks