netdev - Re: Bug? TCP shutdown behaviour when deleting local IP addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50816DE0.4070700@genband.com>
Date:	Fri, 19 Oct 2012 09:12:32 -0600
From:	Chris Friesen <chris.friesen@...band.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	netdev <netdev@...r.kernel.org>,
	David Miller <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	James Morris <jmorris@...ei.org>,
	Patrick McHardy <kaber@...sh.net>,
	Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>
Subject: Re: Bug?  TCP shutdown behaviour when deleting local IP addresses

On 10/18/2012 01:29 AM, Eric Dumazet wrote:
> On Thu, 2012-10-18 at 01:08 -0600, Chris Friesen wrote:
>
>>
>> While I agree generally, it's a bit unfortunate that we can't (as a
>> quality of implementation thing) give an earlier notice of failure since
>> the kernel knows about both ends of the connection even though the IP
>> address is gone.  On the other hand, I imagine that would mean
>> special-casing things and presumably that would open a whole can of worms.
>
> Really what is the difference between a cable cut and what you are
> doing ?
>
> Some frames are lost (Dropped), and sender doesnt 'know' that is
> definitive or temporary failure.
>
> If you want faster response, you need to send RST messages, not dropping
> frames.

After thinking about it for a while, I think you're right.  Initially I 
was expecting that since we know the server side has been taken down we 
should be able to kill the client side, but then I considered the case 
where some sort of of high availability system may have moved the server 
to another host.

> So change your strategy, and add an iptables rule for example ?

That's a good suggestion.  I'll pass it on.

Thanks,
Chris
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html