netdev - Re: icmp redirects problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091124001230.GC14245@samad.com.au>
Date:	Tue, 24 Nov 2009 11:12:30 +1100
From:	Alex Samad <alex@...ad.com.au>
To:	Jarek Poplawski <jarkao2@...il.com>
Cc:	netdev@...r.kernel.org
Subject: Re: icmp redirects problem

On Mon, Nov 23, 2009 at 10:58:38PM +0100, Jarek Poplawski wrote:
> Alex Samad wrote, On 11/23/2009 05:31 AM:
> 

[snip]

> > 
> > laptop gets its ip from dchp server that make 192.168.11.1 the default
> > gateway and its 192.168.11.1 that sends out the icmp redirect.
> 
> Btw, it seems you should fix your routing (by adding sydrt01's eth0
> the second ip or advertising 192.168.11.10 more) to avoid those
> redirects.

sorry I am lost on this statement, I can't add 192.168.11.10 to sydrt01
as it is not physically connected to the 192.168.10.0/24 any more, which
is why I had added the route on sydrt01 and which is why it send
icmp_rediercts.

I have updated the route table on each static machine, but the problem
is on the machines that get their ip via dhcp - I haven't looked at
pushing out route information via dhcp - I am not sure that it would
work in a mixed windows / linux environment.

what do you mean by advertising 192.168.11.10 more ?

> 
> > 
> > I had a quick look at the kernel tree for 2.6.31 (which is what I am
> > using).
> 
> ...
> 
> > Line 680
> >  secure_redirects - BOOLEAN
> >  681         Accept ICMP redirect messages only for gateways,
> >  682         listed in default gateway list.
> >  683         secure_redirects for the interface will be enabled if at
> >  least one of
> >  684         conf/{all,interface}/secure_redirects is set to TRUE,
> >  685         it will be disabled otherwise
> >  686         default TRUE
> 
> Very helpful links. So, as you wrote "the documentation seems to suggest"
> something, and IMHO even if it doesn't, it's needlessly too concise
> considering your "lost time", and I'd suggest you sending a patch to fix
> this. (It seems it could "touch" shared_media, as well.)

Which is wrong the code or the documentation and which part the test or
the reliance on the shared_media or on the redirects flags



> 
> Thanks,
> Jarek P.
> 


Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)