netdev - [PATCH] LVS: Send ICMP unreachable responses to end-users when real-servers are removed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 11 Feb 2007 12:04:43 +0900
From:	Horms <horms@...ge.net.au>
To:	netdev@...r.kernel.org
Cc:	Janusz Krzysztofik <jkrzyszt@....icnet.pl>,
	Julian Anastasov <ja@....bg>,
	Wensong Zhang <wensong@...ux-vs.org>,
	Joseph Mack NA3T <jmack@...d.net>,
	Roberto Nibali <ratz@...gphish.ch>
Subject: [PATCH] LVS: Send ICMP unreachable responses to end-users when real-servers are removed

Hi,

this is a small patch by  Janusz Krzysztofik to ip_route_output_slow()
that allows VIP-less LVS linux director to generate packets originating
>From VIP if sysctl_ip_nonlocal_bind is set.

In a nutshell, the intention is for an LVS linux director to be able
to send ICMP unreachable responses to end-users when real-servers are
removed.

http://archive.linuxvirtualserver.org/html/lvs-users/2007-01/msg00106.html

I'm not really sure about the correctness of this approach,
so I am sending it here to netdev for review

Cc: Janusz Krzysztofik <jkrzyszt@....icnet.pl>
Signed-off-by: Simon Horman <horms@...ge.net.au>

Index: net-2.6/net/ipv4/route.c
===================================================================
--- net-2.6.orig/net/ipv4/route.c	2007-02-11 11:46:08.000000000 +0900
+++ net-2.6/net/ipv4/route.c	2007-02-11 11:46:23.000000000 +0900
@@ -2397,7 +2397,7 @@
 
 		/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
 		dev_out = ip_dev_find(oldflp->fl4_src);
-		if (dev_out == NULL)
+		if ((dev_out == NULL) && !(sysctl_ip_nonlocal_bind))
 			goto out;
 
 		/* I removed check for oif == dev_out->oif here.
@@ -2408,7 +2408,7 @@
 		      of another iface. --ANK
 		 */
 
-		if (oldflp->oif == 0
+		if (dev_out && oldflp->oif == 0
 		    && (MULTICAST(oldflp->fl4_dst) || oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
 			/* Special hack: user can direct multicasts
 			   and limited broadcast via necessary interface
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html