netdev - Re: SO_BINDTODEVICE inconsistency between IPv4 and IPv6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Mar 2011 21:26:51 -0400
From:	Brian Haley <brian.haley@...com>
To:	David Woodhouse <dwmw2@...radead.org>
CC:	netdev@...r.kernel.org,
	"Yuniverg, Michael" <michael.yuniverg@...el.com>,
	"Yedvab, Nadav" <nadav.yedvab@...el.com>
Subject: Re: SO_BINDTODEVICE inconsistency between IPv4 and IPv6

On 03/17/2011 06:29 AM, David Woodhouse wrote:
> We've discovered strange behaviour when we listen on in6addr_any and use
> SO_BINDTODEVICE to bind to the lo device.
> 
> We can connect to any IPv4 address that is local to the machine, on any
> interface. (This is true whether we listen on AF_INET6/in6addr_any and
> accept IPv4 connections on the IPv6 socket, or whether we just listen on
> AF_INET/INADDR_ANY).
> 
> The IPv6 behaviour is different — the only IPv6 address that we can
> connect to is ::1.
> 
> See attached test case, which listens with SO_BINDTODEVICE as described.
> Note that it needs to be run as root because SO_BINDTODEVICE is a
> privileged operation.
> 
> Why this difference? Ideally, we want the Legacy IP behaviour to happen
> for IPv6 too; we want local clients to be able to connect to *any* local
> IP address to talk to our service, but we don't want to accept
> connections from the outside.
> 
<snip>

> telnet> close
> Connection closed.
> [root@...book dwmw2]# telnet 2001:8b0:10b:1:216:eaff:fe05:bbb8 9999
> Trying 2001:8b0:10b:1:216:eaff:fe05:bbb8...
> telnet: connect to address 2001:8b0:10b:1:216:eaff:fe05:bbb8: Connection refused
> telnet: Unable to connect to remote host: Connection refused

Hmm, "connection refused", do you have any iptables rules installed?  Connecting
to a local global address worked fine for me on 2.6.32-30 using a home-grown
test app.

BTW, the one difference you will see with this is that trying to connect to
a link-local won't work without specifying a scope (like an interface), so
that is different than IPv4.

-Brian
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html