netdev - Re: [RFD] First draft of RDNSS-in-RA support for IPv6 DNS autoconfiguration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <OFBCA57EE5.DABFEB20-ON88257303.00601DB3-88257303.00618B1D@us.ibm.com>
Date:	Sat, 23 Jun 2007 10:45:59 -0700
From:	David Stevens <dlstevens@...ibm.com>
To:	Rémi Denis-Courmont <rdenis@...phalempin.com>
Cc:	cananian@...il.com, "C. Scott Ananian" <cscott@...top.org>,
	netdev@...r.kernel.org
Subject: Re: [RFD] First draft of RDNSS-in-RA support for IPv6 DNS autoconfiguration

Rémi Denis-Courmont <rdenis@...phalempin.com> wrote on 06/23/2007 09:51:55 
AM:

> How do I authenticate SeND RA? How do I deal with the link going down 
> before the expiration? How do I know "this" interface is doing autoconf 
> at all?

        The kernel should do the authentication, as it will for other 
RA's,
and should not deliver (IMAO) unauthenticated packets. If it is, I would
consider that a bug (for all cases, not just this), and that would be a
good thing to fix. :-)
        An interface going down doesn't directly invalidate a DNS server
address, though it may not be the best through another interface. Since
it is a list, I think "doing nothing" for this case wouldn't be terrible.
This is no worse than the existing resolver code. But if you really need 
it,
you can monitor netlink, or poll the interface flags on whatever interval 
you
require for detection.
        As for autoconf, that's available from sysctl, I assume from /proc
somewhere, too. That usually doesn't change, but if you want to account
for runtime configuration changes, you can always monitor netlink and
reread when new addresses appear, too.

        There certainly may be complications I haven't thought of, since
I haven't implemented it. But I still don't see a good case for using the
kernel as a DNS database.

                                                                +-DLS

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html