netdev - Re: Interface without IP address can route??

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 24 Aug 2011 09:01:30 -0400
From:	jamal <hadi@...erus.ca>
To:	Ben Greear <greearb@...delatech.com>
Cc:	netdev <netdev@...r.kernel.org>
Subject: Re: Interface without IP address can route??


It makes sense to behave this way.
IPv4 addresses are owned by the system not interfaces.
If you want to control the forwarding behavior, control ARP so it doesnt
respond on the interfaces with no IP.

cheers,
jamal
On Tue, 2011-08-23 at 17:20 -0700, Ben Greear wrote:
> I just noticed on a 3.0.1 kernel that the system is routing packets
> received on an interface without an IP address. (I was trying to use the
> interface in a user-space wifi_station-to-wired bridge application).
> 
> [root@...301-demo1 lanforge]# cat /proc/sys/net/ipv4/conf/sta1/forwarding
> 1
> [root@...301-demo1 lanforge]# ifconfig sta1
> sta1      Link encap:Ethernet  HWaddr 00:03:2D:12:16:0D
>            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>            RX packets:85248 errors:0 dropped:0 overruns:0 frame:0
>            TX packets:1419 errors:0 dropped:0 overruns:0 carrier:0
>            collisions:0 txqueuelen:1000
>            RX bytes:67423391 (64.2 MiB)  TX bytes:1087581 (1.0 MiB)
> 
> 
> Seems that older stock kernels have forwarding set for interfaces without
> IP addresses too, so maybe it's always been this way...
> 
> Anyway, I can add some logic to my config to explicitly disable
> routing for interfaces w/out IP address, but it seems to me that
> it should automatically not route packets received on an interface
> that had no IP address on it..
> 
> Thanks,
> Ben
> 


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html