netdev - Re: [PATCH net-next-2.6] ipv4: sysctl to block responding on down interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20100622.101537.245382806.davem@davemloft.net>
Date:	Tue, 22 Jun 2010 10:15:37 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	shemminger@...tta.com
Cc:	joakim.tjernlund@...nsmode.se, netdev@...r.kernel.org
Subject: Re: [PATCH net-next-2.6] ipv4: sysctl to block responding on down
 interface

From: Stephen Hemminger <shemminger@...tta.com>
Date: Fri, 11 Jun 2010 08:48:54 -0700

> The initial problem report was for a management application that used ICMP
> to check link availability.

That application is buggy, and even if we apply this patch it will
only properly function when speaking to systems in a non-default
configuration.  And, it would be a non-default setting which, by your
own admission below, cannot function properly in valid interface
configurations.

It's easier to fix the app to work in all cases than to add another
sysctl knob hack for a segment of the world that can't seem to wrap
their head around the fact that our behavior is valid, specified, and
an explicit design decision meant to increase the chances of
successful communication between two systems.

> The default is disabled to maintain compatibility with previous behavior.
> This is not recommended for server systems because it makes fail over more
> difficult, and does not account for configurations where multiple interfaces
> have the same IP address.

The fact that the syctl knob, when enabled, can't even function properly
in this "multiple interfaces with same address" case is another reason I
have decided to not apply this.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html