netdev - Re: [PATCH v2] ipv6: Use inbound ifaddr as source addresses for ICMPv6 errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 28 Aug 2016 19:18:00 +0200
From:   Guillaume Nault <g.nault@...halink.fr>
To:     Eli Cooper <elicooper@....com>
Cc:     netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
        Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
Subject: Re: [PATCH v2] ipv6: Use inbound ifaddr as source addresses for
 ICMPv6 errors

On Sun, Aug 28, 2016 at 11:34:06AM +0800, Eli Cooper wrote:
> According to RFC 1885 2.2(c), the source address of ICMPv6
> errors in response to forwarded packets should be set to the
> unicast address of the forwarding interface in order to be helpful
> in diagnosis.
> 
FWIW, this behaviour has been deprecated ten years ago by RFC 4443:
"The address SHOULD be chosen according to the rules that would be used
 to select the source address for any other packet originated by the
 node, given the destination address of the packet."

The door is left open for other address selection algorithms but, IMHO,
changing kernel's behaviour is better justified by real use cases
than by obsolete RFCs.