netdev - [PATCH] Re: Loopback address to eth0 interface and rooting goes wrong

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 24 Jan 2008 09:08:02 +0100
From:	Bjørn Mork <bjorn@...k.no>
To:	netdev@...r.kernel.org
Cc:	Varun Chandramohan <varunc@...ux.vnet.ibm.com>,
	Gary <gary.manchon@...il.com>,
	Breno Leitao <leitao@...ux.vnet.ibm.com>, ecki@...a.inka.de
Subject: [PATCH] Re: Loopback address to eth0 interface and rooting goes wrong

Hello

Gary < gary.manchon (at) gmail.com > found a problem where he was unable
to recover from a bad network interface configuration 
(ifconfig eth0 127.0.0.1), ref 
http://www.uwsg.iu.edu/hypermail/linux/net/0801.2/0009.html

This was confirmed by several people.

I suspect that the problem might be this code in net/ipv4/devinet.c ,
which sets ifa_scope to RT_SCOPE_HOST if you configure a loopback
address (127/8) on any interface.  I guess it's there to protect us from
sending packets with a loopback source address, which woulnd't look too
good:

static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
{
	struct in_device *in_dev = __in_dev_get_rtnl(dev);

	ASSERT_RTNL();

	if (!in_dev) {
		inet_free_ifa(ifa);
		return -ENOBUFS;
	}
	ipv4_devconf_setall(in_dev);
	if (ifa->ifa_dev != in_dev) {
		BUG_TRAP(!ifa->ifa_dev);
		in_dev_hold(in_dev);
		ifa->ifa_dev = in_dev;
	}
	if (LOOPBACK(ifa->ifa_local))
		ifa->ifa_scope = RT_SCOPE_HOST;
	return inet_insert_ifa(ifa);
}

The real problem is that there's never anything resetting this scope if
you change the address later.  This patch adds scope reset when changing
the address.

View attachment "devinet-rt_scope-fix.patch" of type "text/x-diff" (719 bytes)

Bjørn