netdev - Re: [PATCH] IPv4 Multicast: prevent reception of mcast frames from unjoined groups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 11 Jul 2008 20:48:01 +0400
From:	Alexey Kuznetsov <kuznet@....inr.ac.ru>
To:	Neil Horman <nhorman@...driver.com>
Cc:	netdev@...r.kernel.org, davem@...emloft.net, pekkas@...core.fi,
	jmorris@...ei.org, yoshfuji@...ux-ipv6.org, kaber@...sh.net,
	dlstevens@...ibm.com
Subject: Re: [PATCH] IPv4 Multicast: prevent reception of mcast frames from unjoined groups

Hello!

> The current ipv4 multicast code incorrectly allows frames destined to any
> multicast group to be received on any socket that is bound to INADDR_ANY,

Yes, it used to behave this way.

And this is more fresh (than reference to practice in days of yore :-))
rationale given by David Stevens:


> Subject: Re: [PATCH] make ipv4 multicast packets only get delivered to sockets	that
>  are joined to group
> From: David Stevens <dlstevens@...ibm.com>
> Date: Thu, 14 Sep 2006 08:39:39 -0700
> 
> Alexey Kuznetsov <kuznet@....inr.ac.ru> wrote on 09/14/2006 03:30:37 AM:
> 
> > Hello!
> > 
> > >         No, it returns 1 (allow) if there are no filters to explicitly
> > > filter it. I wrote that code. :-)
> > 
> > I see. It did not behave this way old times.
> > 
> > From your mails I understood that current behaviour matches another
> > implementations (BSD whatever), is it true?
> 
> Hi, Alexey,
> 
> If you mean IPv6 code in current BSD derivatives, I don't know.
> 
> The IPv6 behaviour was different from IPv4 on Linux and was changed for
> compatibility with IPv4 (discussion on netdev agreed that binding
> should determine socket delivery, not group membership, or simply
> that there was no reason to be different from long-standing IPv4 
> practice).
> 
> The IPv4 code is that way for compatibility with everything else since
> about ~4.3BSD (with the possible exception of Solaris 8, apparently).
> 
> FWIW, I think Deering's original interpretation is correct. Adding
> a multicast address to an interface by joining a group is little
> different from adding a unicast address via SIOCSIFADDR, which
> certainly does affect packets delivered to the machine and to any
> INADDR_ANY-bound socket. Binding to the multicast address and not
> INADDR_ANY will give you only packets for that group, if that's
> what you want, just as in the unicast address-specific bind.
> 
>                                                         +-DLS
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html