lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:	Tue, 04 Aug 2009 19:33:44 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	chiachi@...roid.com
Cc:	john.dykstra1@...il.com, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH] net: Keep interface binding when sending packets with
 ipi_ifindex = 0

From: Chia-chi Yeh (葉家齊) <chiachi@...roid.com>
Date: Wed, 5 Aug 2009 08:06:25 +0800

> 2009/8/5 David Miller <davem@...emloft.net>:
>> I think we really cannot change behavior here.  If the user specifies
>> "0" in ipi_ifindex we must respect that in ipc->oif.  This is an
>> override, and the ability to override is the very purpose of this
>> control message.
>>
>> Even GLIBC makes use of that case of specifying "0" in ipi_ifindex.
>> We must respect it.
>>
>> I'm not applying any of these patches, sorry.
>>
> 
> If you treat ipi_ifindex as an override, do you want to do that in
> ipi6_ifindex as well? Also, CAP_NET_RAW check for SO_BINDTODEVICE
> becomes meaningless in this case.

ipi_ifindex influences routing decisions, it doesn't also influence
socket matching like SO_BINDTODEVICE does.

That's the crucial difference.

This interface index gets passed into the routing lookup and that is
completely harmless to allow users to do.

About ipv6 it is indeed an important issue, because apps that work now
with ipv4's behavior are going to break if they care about this case
when they start using ipv6.  Probably the thing to do is make ipv6
work the same as ipv4.

> I did not find the usage of ipi_ifindex in glibc. It would be great if
> you can give me some pointers. Thanks for your help.

If grep is broken on your system, I'm sorry to hear that:

	find . -type f | xargs egrep IP_PKTINFO

Give that a try on your glibc tree.

Powered by blists - more mailing lists