netdev - Re: [PATCH v3 2/2] Implement IPV6_UNICAST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 06 Feb 2012 22:00:05 -0500
From:	Brian Haley <brian.haley@...com>
To:	"Erich E. Hoover" <ehoover@...es.edu>
CC:	Linux Netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH v3 2/2] Implement IPV6_UNICAST_IF socket option.

On 02/06/2012 05:11 PM, Erich E. Hoover wrote:
> On Mon, Feb 6, 2012 at 2:13 PM, Brian Haley <brian.haley@...com> wrote:
>> On 02/06/2012 12:57 PM, Erich E. Hoover wrote:
>>> ...
>>> +     int                     outif_index;
>> ...
>> Nitpick: is ucast_oif a better name?
> 
> I templated off of the IPv4 code (example: mc_index), but I do think
> that that is a better name.  Should I call the IPv4 version
> "ucast_index" or have the same name for both IPv4 and IPv6?

If it was me I'd call it uc_index for IPv4, to mimic mc_ifindex.

>>> diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
>>> index 01d46bf..18f144e 100644
>>> --- a/net/ipv6/icmp.c
>>> +++ b/net/ipv6/icmp.c
>>> @@ -551,6 +551,9 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
>>>               return;
>>>       np = inet6_sk(sk);
>>>
>>> +     if (!fl6.flowi6_oif)
>>> +             fl6.flowi6_oif = ipv6_default_ifindex(sk);
>>> +
>>>       if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
>>>               fl6.flowi6_oif = np->mcast_oif;
>>
>> This snippet shows (and rawv6_sendmsg() has the same problem), that
>> IPV6_UNICAST_IF can also affect multicast packets.  And I think we always want
>> SO_BINDTODEVICE to override them all.  Perhaps these checks should be:
>> ...
> 
> I'll double check all of these tonight, but a cursory look seems to
> indicate that the multicast check is the right place to put this for
> all the files.  I'm sorry about that, I clearly didn't consider
> interfering with multicast.

It's probably important to keep the precedence the same as before:

	SO_BINDTODEVICE
	IPV6_PKTINFO
	IPV6_*CAST_IF

It looks like your IPv4 changes have the same problem.

-Brian
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html