linux-kernel - /proc/sys/net/ip*/conf/all/* does not actually affect interfaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090302122718.GA3906@piper.oerlikon.madduck.net>
Date:	Mon, 2 Mar 2009 13:27:18 +0100
From:	martin f krafft <madduck@...duck.net>
To:	linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: /proc/sys/net/ip*/conf/all/* does not actually affect interfaces

Dear kernel gurus,

I was unpleasantly surprised last night that a rogue machine managed
to alter the IPv6 default route of one of my servers, despite my
sysctl configuration, which disables RA for "all" interfaces during
the boot sequence. It also changes the "default" values:

  net.ipv6.conf.default.autoconf = 0
  net.ipv6.conf.default.accept_ra = 0
  net.ipv6.conf.default.accept_ra_defrtr = 0
  net.ipv6.conf.default.accept_ra_pinfo = 0
  net.ipv6.conf.default.accept_source_route = 0
  net.ipv6.conf.default.accept_redirects = 0
  net.ipv6.conf.default.forwarding = 0
  net.ipv6.conf.all.autoconf = 0
  net.ipv6.conf.all.accept_ra = 0
  net.ipv6.conf.all.accept_ra_defrtr = 0
  net.ipv6.conf.all.accept_ra_pinfo = 0
  net.ipv6.conf.all.accept_source_route = 0
  net.ipv6.conf.all.accept_redirects = 0
  net.ipv6.conf.all.forwarding = 0

Yet, net.ipv6.conf.eth0.* values were unchanged, and routing
advertisements honoured.

This also applies to files in ipv4/, e.g. accept_redirects

A bit of investigation shows that something fishy is going on, or
at least it's unexpected to me, because I recall the conf/all/*
interface to do what it promised to do a while ago. Not anymore
though.

seamus# pwd
/proc/sys/net
seamus# head ipv4/conf/{all,eth0}/accept_redirects  
==> ipv4/conf/all/accept_redirects <==
1

==> ipv4/conf/eth0/accept_redirects <==
1
seamus# echo 0 >| ipv4/conf/all/accept_redirects  
seamus# head ipv4/conf/{all,eth0}/accept_redirects  
==> ipv4/conf/all/accept_redirects <==
0

==> ipv4/conf/eth0/accept_redirects <==
1



***** shouldn't ipv4/conf/eth0/accept_redirects be 0 too??


same with ipv6:

seamus# head ipv6/conf/{all,eth0}/accept_ra
==> ipv6/conf/all/accept_ra <==
1

==> ipv6/conf/eth0/accept_ra <==
1
seamus# echo 0 >| ipv6/conf/all/accept_ra
seamus# head ipv6/conf/{all,eth0}/accept_ra
==> ipv6/conf/all/accept_ra <==
0

==> ipv6/conf/eth0/accept_ra <==
1



What is going on? Is this my fault, did something change in the
kernel, or is this a bug?

-- 
martin | http://madduck.net/ | http://two.sentenc.es/
 
"in the figure of the president, george w. bush, the incompetence,
 stupidity, and sheer inhumanity that characterize so much of
 america's money-mad corporate elite find their quintessentially
 repulsive expression."
                                 -- journalist, aftermath of katrina
 
spamtraps: madduck.bogus@...duck.net

Download attachment "digital_signature_gpg.asc" of type "application/pgp-signature" (198 bytes)