netdev - Re: [PATCH] net: Keep interface binding when sending packets with ipi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20090804.193344.71849943.davem@davemloft.net>
Date:	Tue, 04 Aug 2009 19:33:44 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	chiachi@...roid.com
Cc:	john.dykstra1@...il.com, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH] net: Keep interface binding when sending packets with
 ipi_ifindex = 0

From: Chia-chi Yeh (葉家齊) <chiachi@...roid.com>
Date: Wed, 5 Aug 2009 08:06:25 +0800

> 2009/8/5 David Miller <davem@...emloft.net>:
>> I think we really cannot change behavior here.  If the user specifies
>> "0" in ipi_ifindex we must respect that in ipc->oif.  This is an
>> override, and the ability to override is the very purpose of this
>> control message.
>>
>> Even GLIBC makes use of that case of specifying "0" in ipi_ifindex.
>> We must respect it.
>>
>> I'm not applying any of these patches, sorry.
>>
> 
> If you treat ipi_ifindex as an override, do you want to do that in
> ipi6_ifindex as well? Also, CAP_NET_RAW check for SO_BINDTODEVICE
> becomes meaningless in this case.

ipi_ifindex influences routing decisions, it doesn't also influence
socket matching like SO_BINDTODEVICE does.

That's the crucial difference.

This interface index gets passed into the routing lookup and that is
completely harmless to allow users to do.

About ipv6 it is indeed an important issue, because apps that work now
with ipv4's behavior are going to break if they care about this case
when they start using ipv6.  Probably the thing to do is make ipv6
work the same as ipv4.

> I did not find the usage of ipi_ifindex in glibc. It would be great if
> you can give me some pointers. Thanks for your help.

If grep is broken on your system, I'm sorry to hear that:

	find . -type f | xargs egrep IP_PKTINFO

Give that a try on your glibc tree.