netdev - Re: [RFC] arp announce, arp_proxy and windows ip conflict verification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m1iqicyjmr.fsf@fess.ebiederm.org>
Date:	Tue, 30 Jun 2009 23:58:36 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Denys Fedoryschenko <denys@...p.net.lb>
Cc:	netdev@...r.kernel.org, David Miller <davem@...emloft.net>
Subject: Re: [RFC] arp announce, arp_proxy and windows ip conflict verification

Denys Fedoryschenko <denys@...p.net.lb> writes:

> On Wednesday 01 July 2009 01:55:59 Eric W. Biederman wrote:
>>
>> I have a problem with this patch.  It stops gratuitous arps updating
>> my arp cache.  I'm still trying to figure out what the correct behaviour
>> should be.
>>
>> Perhaps making the goto out; become if (sip == 0) goto out;
> Yes, you are right. 
>
> Proposing 3 simple patches against git next-next-2.6 . As attaches (sorry, 
> kmail). All of them equal, but since i am amateur in programming, i dont know 
> how it is should be done "nice way".
>
> If you want to test it - do it carefully. I didn't did runtime tests yet, but 
> they are compile tested. (But they are trivial).
>
> If someone can review and tell if any of them ok, i will submit it with proper 
> tags and etc.

What problem were you originally trying to solve?

Having a proxy arp gateway reply to addresses it routes is proper
behaviour.

There are some aspects of RFC 5227 ipv4 address conflict detection that
we could implement in a better fashion.  In particular the entirety
of handling the pathological case of someone using one of our ip
addresses in an arp message and replying to them to defend ourselves.

Your changes seem aimed at having the linux kernel not reply to
gratuitous arps, when according to our configuration the sender is
misconfigured.  You seem to want linux not to defend itself in cases
where it should.  Making us even less compliant with RFC 5227.

Eric

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html