netdev - Re: [RFC] ipv6: use a random ifid for headerless devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 8 Dec 2015 14:44:13 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	Bjørn Mork <bjorn@...k.no>
Cc:	netdev@...r.kernel.org,
	吉藤英明 <hideaki.yoshifuji@...aclelinux.com>
Subject: Re: [RFC] ipv6: use a random ifid for headerless devices

On 05.12.2015 20:02, Bjørn Mork wrote:
> Hannes Frederic Sowa <hannes@...essinduktion.org> writes:
>> On Thu, Dec 3, 2015, at 20:29, Bjørn Mork wrote:
>>
>>> After looking more at addrconf, I started wondering if we couldn't abuse
>>> ipv6_generate_stable_address() for this purpose?  We could add a new
>>> addr_gen_mode which would trigger automatic generation of a secret if
>>> stable_secret is uninitialized.  This would be good enough to ensure
>>> stability until the interface is destroyed.  And it would still allow
>>> the adminstrator to select IN6_ADDR_GEN_MODE_STABLE_PRIVACY by entering
>>> a new secret.
>>
>> I am fine with your proposal but I would really like to see it only
>> happen on the per-interface stable_secret instance.
> 
> Do you think something like the patch below will be OK?

I wouldn't call it IN6_ADDR_GEN_MODE_AUTO, this doesn't say anything.
But the idea is already good.

> Or would it be better to drop the additional mode and just generate a
> random secret if the mode is IN6_ADDR_GEN_MODE_STABLE_PRIVACY and the
> secrets are missing?  Or would that be changing the userspace ABI?  This
> is not clear to me...

I would not like to do that somehow. The problem is that the stable
secrets get written by user space probably during boot-up, but we don't
know when. That's why I would also not set the ->initialized flag, so
user can overwrite it to the final secret later on. We block it otherwise.

My proposal would be to use the stable privacy generator in case the
device does not have a device address for EUI-48 generation with a
secret which we simply generate on the stack. Let's factor out the part
of the generator which depends on the inet6_dev and cnf bits for that.

What do you think?

Bye,
Hannes

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html