netdev - Re: [PATCH v2] bonding: move IPv6 support into a separate kernel module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 26 Feb 2009 10:14:33 -0800
From:	Jay Vosburgh <fubar@...ibm.com>
To:	Brian Haley <brian.haley@...com>
cc:	David Miller <davem@...emloft.net>, arvidjaar@...l.ru,
	vladislav.yasevich@...com, chuck.lever@...cle.com, tytso@....edu,
	Valdis.Kletnieks@...edu, rjw@...k.pl, netdev@...r.kernel.org,
	bonding-devel@...ts.sourceforge.net, jamagallon@....com,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] bonding: move IPv6 support into a separate kernel module

Brian Haley <brian.haley@...com> wrote:

>David Miller wrote:
>> From: Jay Vosburgh <fubar@...ibm.com>
>> Date: Wed, 25 Feb 2009 14:10:58 -0800
>>
>>> 	I've been fooling with the disable_ipv6 sysctl, and one issue is
>>> that, at least on the distro I'm testing on (SLES), it's not picked up
>>> from /etc/sysctl.conf at boot time (presumably because ipv6 isn't loaded
>>> yet, although I haven't really checked).
>>
>> Correct, that's the problem.
>>
>> We could create a blocker bitmap.  Two sysctls, "block_af" and
>> "unblock_af".  You write the AF_foo value for the protocol there and
>> it sets or clears the assosciated bit in the internal blocker bitmap.
>>
>> Things like sys_socket() et al. key off of this.
>
>I'm open to suggestions at this point in time, I just don't see how this
>will solve the bonding problem since it still wouldn't load, right?

	It would permit users to load ipv6 (thus allowing bonding to
load), but prevent ipv6 from actually doing anything.  (because
sys_socket, e.g., won't open an ipv6 socket if block_af includes ipv6).

	Actually, __sock_create might be the better place to put the
hook for "create a socket"; there would probably need to be a check
within the protocol code as well, so that, e.g., ipv6 addrconf won't run
if AF_INET6 is disabled.

>Dave - do you feel I need to fix this regression?  If not I can try to
>work on this AF blocker thing.  My only other thought if we want to fix
>this is to have the IPv6 module register these five functions into an ops
>structure that bonding can call.  It doesn't fix SCTP, qeth, etc, but it
>gets these "blacklist ipv6" configs working again, and gets me out of the
>crosshairs :)

	I think the problem (customers want to disable ipv6 and use
bonding, sctp, qeth, whatever) needs to be fixed.  If it's not, I'm sure
I'll be getting lots of cards and letters from customers.

	I don't think the solution needs to preserve the current
solution (preventing the ipv6 module from loading).  Ipv6 being unusable
should be sufficient.  Except perhaps in an embedded environment, but
they're probably in a position to compile their kernel without ipv6.

	Another possible resolution is to modify the initscripts in the
distros to perform sysctl -p (read sysctls from /etc/sysctl.conf) after
ipv6 is loaded, so that the disable_ipv6 sysctl can be set.  That seems
like more work, and is limited to ipv6, so I don't see it as being
better than a "kernel shut off AF_xxx" type of solution.

	-J

---
	-Jay Vosburgh, IBM Linux Technology Center, fubar@...ibm.com
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html