linux-kernel - Re: DHCP and iptables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091013004140.84685h783tt8jfcw@www.kundendienste.net>
Date:	Tue, 13 Oct 2009 00:41:40 +0200
From:	lkml@...ubi.at
To:	Arnd Bergmann <arndbergmann@...glemail.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: DHCP and iptables

Well, but for example ICMP also uses raw sockets and gets blocked if I  
do not explicit allow it, doesn't it?

> On Monday 12 October 2009, lkml@...ubi.at wrote:
>> Well, I just looked for "ethernet protocol" and read some things about
>> DHCP again.
>>
>> What's an ethernet protocol?
>>
>> I also read, that "DHCP is built directly on UDP and IP" (RFC 2131).
>>
>> It uses Ports (UDP 67/68) and the source address of the DHCP server is
>> an IP address.
>
> Ah, right. I confused it with the way that the ancient RARP protocol did
> this before DHCP.
>
> Sorry for the confusion.
>
>> Could you answer me more in detail, why I get an IP, but block
>> everything with iptables?
>
> The dhcp client opens a raw packet socket at the ethernet device
> (if I'm not mistaken again), because there is no IP address assigned
> with the netdev at that time. This allows it to send and receive
> ethernet frames, bypassing the TCP/IP stack.
>
> 	Arnd <><
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/