netdev - Re: assigning an entire subnet of addresses to an interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 3 Feb 2013 23:00:57 +0100
From:	David Madore <david+ml@...ore.org>
To:	netdev@...r.kernel.org
Cc:	Lukas Tribus <luky-37@...mail.com>
Subject: Re: assigning an entire subnet of addresses to an interface

On Sun, Feb 03, 2013 at 10:45:45PM +0100, Lukas Tribus wrote:
> The feature you are looking for is called "Transparent proxy support" or
> TPROXY, and is in the kernel since 2.6.28.
> 
> This allows an application to bind to any address and handle that traffic.

This is indeed, interesting, and I'm glad you pointed out this
possibility, because it had escaped my radar.  (Note that there are
two slightly different things, though: the TPROXY iptables/ip6tables
target which redirects packets to a local socket, and the IP-level
IP_TRANSPARENT socket option which allows a user application to bind
to an arbitrary address.  The latter is closer to what I was asking.)

However, this still does not really answer my question: to bind to
127.1.2.3 one does not need to do a prior setsockopt(fd, SOL_IP,
IP_TRANSPARENT, &1), so the kernel does seem to have a way to say "for
this entire subnet, it will be possible to bind to any address without
doing anything special".

Happy hacking,

-- 
     David A. Madore
   ( http://www.madore.org/~david/ )
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html