netdev - Re: [IPV4] LVS: Allow to send ICMP unreachable responses when real-servers are removed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4648714E.9050200@tis.icnet.pl>
Date:	Mon, 14 May 2007 16:25:18 +0200
From:	Janusz Krzysztofik <jkrzyszt@....icnet.pl>
To:	David Miller <davem@...emloft.net>
CC:	kaber@...sh.net, horms@...ge.net.au, netdev@...r.kernel.org
Subject: Re: [IPV4] LVS: Allow to send ICMP unreachable responses when real-servers
 are removed

David Miller wrote:
> From: Patrick McHardy <kaber@...sh.net>
> Date: Mon, 14 May 2007 12:21:34 +0200
> 
>> This allows any user to send spoofed packets when ip_nonlocal_bind
>> is set, which is a quite big change in behaviour of this option.
>> The TPROXY patches include a similar change, but use a flag in
>> struct flowi that requires CAP_NET_ADMIN to be set, which seems like
>> a better idea. Alternatively you could just use input routing for
>> non-local source addresses like ip_route_me_harder does.
> 
> Good point.
> 
>> BTW, there doesn't even seem to be a spot where IPVS calls
>> ip_route_output with the source address set. What exactly is this
>> needed for?
> 
> I suppose he has a patch to make use of it, but was waiting
> for this route.c change to go in first.

If you mean me, the answer is no, I do not have any patch making use of 
the change in question. What I have is rather a complicated method of 
notifying udp clients on communication problems before they are 
redirected to a new real server. My method needs some IPVS related 
patches, but ICMP port unreachable messages are not generated inside 
IPVS code, they are just sent, with help of the patch in question, from 
udp_input() or netfilter REJECT.

It was my first intention to patch IPVS to send these messages, but I 
found no simple way to implement this in the current IPVS code.

Janusz

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html