netdev - Source routing without rules?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrVRZF0XLtH9o37Y=ZVMyyExBs7dLYFLOgJ-=vFqy+a_ig@mail.gmail.com>
Date:	Tue, 27 Aug 2013 17:16:21 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Network Development <netdev@...r.kernel.org>
Subject: Source routing without rules?

I'm about to implement a trivial source routing policy for the third
time, and this is IMO stupid.  I want to have two routes to a network.
 Each route should specify a src, and, if the flow matches the src,
then that route should win.

The rules that don't work are:

ip route add <net> via <gw1> dev <dev1> metric 0
ip route add <net> via <gw2> dev <dev2> src <dev2addr> metric 10

Even if I bind a socket to dev2addr, the outgoing packets go out dev1
to gw1.  This is exactly what I don't want to have happen.

This would fix it:

ip route add <net> via <gw1> dev <dev1> src <dev1addr> metric 0 match_src
ip route add <net> via <gw2> dev <dev2> src <dev2addr> metric 10

The semantics of match_src would be that, if set, the route only
matches if the flow has no assigned source address or if the assigned
source address matches.

(Also, if SO_BINDTODEVICE didn't require privilege, that would already
work.  Should there be a sysctl to allow anyone to use
SO_BINDTODEVICE?)

--Andy
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html