netdev - Re: [PATCH 2.6] [IPV6] MCAST: Ensure to check multicast listener(s).

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080331.115001.70855239.yoshfuji@linux-ipv6.org>
Date:	Mon, 31 Mar 2008 11:50:01 +0900 (JST)
From:	YOSHIFUJI Hideaki / 吉藤英明 
	<yoshfuji@...ux-ipv6.org>
To:	dlstevens@...ibm.com
Cc:	davem@...emloft.net, netdev@...r.kernel.org,
	yoshfuji@...ux-ipv6.org
Subject: Re: [PATCH 2.6] [IPV6] MCAST: Ensure to check multicast
 listener(s).

In article <OF02C9B6A8.C301DBC1-ON8825741C.006D7AD5-8825741C.006E608E@...ibm.com> (at Sun, 30 Mar 2008 13:05:36 -0700), David Stevens <dlstevens@...ibm.com> says:

> > L2 is expected to pass all multicast to L3, but even with those flags,
> > we should filter them according to our listeners, upper layer
> > (extension header etc.) should not see them.
> 
> Yoshifuji-san,
>         I would assume that IFF_PROMISC or IFF_ALLMULTI means that an
> INADDR_ANY listener would receive all multicasts on the link, not
> just ones for groups that have been joined. This would be particularly
> useful for older version multicast routers or monitoring programs.
> Doesn't your change remove this capability?

No, do not mix L2 and L3 here, and AFAIK, BSDs does not mix also.
Regardless if IFF_PROMISC and/or IFF_ALLMULTI is set, packet delivery
to standard sockets must not be changed.
This does NOT change OLDER applications because we did not have this
kind of confusion before.

>         If the flags are not set, the check for group membership is
> done. My concern is that when one or both are set, your change
> appears to prevent delivery of multicasts that currently are
> delivered, meaning that you can't write an application that, for
> example, monitors all multicast packets, short of joining all
> groups or using a packet socket. If the IFF_ALLMULTI flag isn't
> equivalent, for INADDR_ANY-bound sockets, of joining all groups,
> then I don't see that it has any purpose at all.

Even if IFF_PROMISC is set we do not receive unicast packet on  
standard socket bound on ::.  Same for multicast.
Current behavior is broken (*) and must be fixed.
If you really really want the short-cut, we could introduce a new 
socket option (say, IPV6_MULTICAST_ALL).

*: It was slightly broken before the commit, and 2.4 is not broken.

--yoshfuji
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html