netdev - RE: assigning an entire subnet of addresses to an interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 3 Feb 2013 22:45:45 +0100
From:	Lukas Tribus <luky-37@...mail.com>
To:	<david+ml@...ore.org>, <netdev@...r.kernel.org>
Subject: RE: assigning an entire subnet of addresses to an interface


The feature you are looking for is called "Transparent proxy support" or
TPROXY, and is in the kernel since 2.6.28.

This allows an application to bind to any address and handle that traffic.

One of the applications supporting this feature is HAproxy:
http://cbonte.github.com/haproxy-dconv/configuration-1.5.html#5-transparent





> Date: Sun, 3 Feb 2013 21:51:24 +0100
> From: david+ml@...ore.org
> To: netdev@...r.kernel.org
> Subject: assigning an entire subnet of addresses to an interface
> 
> Dear list,
> 
> Is there a way to assign an entire subnet of (typically IPv6)
> addresses to an interface?  For example, I'd like to assign the entire
> 2001:db8:f00f::/48 prefix to eth42 without actually running 2^80
> separate "ip addr add" commands.
> 
> I'm aware that (with sufficiently recent kernels) one can do this:
> 
> ip -6 route add local 2001:db8:f00f::/48 dev lo
> 
> - which will cause packets received for any address in this subnet to
> be handled locally.  But that doesn't really answer my question,
> because this does not allow local processes to bind to any desired
> address in the subnet (e.g., running "socat
> 'TCP6-LISTEN:9876,bind=[2001:db8:f00f::3141:5926]'" fails with
> EADDRNOTAVAIL).
> 
> Now apparently Linux _does_ have features which allow a process to
> bind to any desired address in a subnet, since this is the case for
> the IPv4 127.0.0.0/8 standard loopback (I can run "socat
> 'TCP-LISTEN:9876,bind=[127.1.2.3]' -" without error).  In a naïve
> move, I tried to reproduce the output of ip addr show for the
> 127.0.0.0/8 subnet as input, but failed (there's an extra word "lo" in
> the output that ip does not allow back as input).  Is this because
> this subnet is really magical to the kernel, or because ip input
> parsing is incomplete, or for some other reason?
> 
> If the feature is not presently available in Linux, is there some hope
> that it eventually will be?  How hard would it be to add it?
> 
> Thanks in advance,
> 
> -- 
>      David A. Madore
>    ( http://www.madore.org/~david/ )
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
 		 	   		  --
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html