Orbot is leaking ICMP traffic on Android

[ihateprogramming88]

Describe the Bug
After testing with termux and orbot, it has been established that ICMP traffic is being leaked with Orbot
To Reproduce
Install Termux, establish the vpn tunnel on orbot and run ping google.com on Termux.

for UDP nc -vz -u 8.8.8.8 443
possibly leaking UDP?

• Device: Pixel 8 Pro
• OS: GrapheneOS Android 14
• Version: Orbot for Android 17.1.1 BETA 2 (tor 0.4.7.8)

[Woman-at-arms]

I can reproduce this issue using ping in Termux.

I have Orbot configured as a VPN, connected, and the Android VPN kill switch is enabled for the VPN.

Orbot appears to be leaking ICMP traffic through the VPN.

[Woman-at-arms]

Uh oh.

It ALSO leaks UDP.

You can confirm this with nc -vz -u 8.8.8.8 443 in termux.

[Woman-at-arms]

Netcat test isn't accurate. My mistake!

[ghost]

@n8fr8 and @bitmold and @meenbeese pleese take a look

[n8fr8]

Yes we are.

…

On Thu, Nov 2, 2023, at 7:13 PM, Ufyfughx wrote: @n8fr8 <https://github.com/n8fr8> and @bitmold <https://github.com/bitmold> and @meenbeese <https://github.com/meenbeese> pleese take a look — Reply to this email directly, view it on GitHub <#1008 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAHRAYUZHVTCKE3Z2VWMQTYCQSIBAVCNFSM6AAAAAA62JH3HKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTOOJRGY4DSMBXGA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[n8fr8]

There have been some issues with Android VPN leaking related to connectivity checks - could this be related?

https://www.ipvanish.com/blog/android-vpn-leaks/

[n8fr8]

https://mullvad.net/en/help/configure-connectivity-checks-on-android/

[n8fr8]

for testing: https://github.com/guardianproject/orbot/releases/tag/17.1.1-BETA-3-tor-0.4.8.7

[trinity-1686a]

Have you confirmed there is a leak, for instance by running tcpdump on your wifi access point?
When I reproduce the experiment, I get the same results, but nothings leak to the access point. Additionally, if I try pinging IPs that shouldn't answer (172.16.1.1, private network, or 203.0.113.1, "provided for use in documentation"), they answer, with ~1ms latency and a ttl of 64.
So far, I think some component of Orbot is just replying itself to every icmp echo request/ping it sees