netdev - Re: [PATCH] IPv6: add option to use Subnet-Router anycast addresses as source addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 02 Jan 2014 19:16:33 +0400
From:	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
To:	Francois-Xavier Le Bail <fx.lebail@...oo.com>,
	netdev@...r.kernel.org
CC:	"David S. Miller" <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	James Morris <jmorris@...ei.org>,
	Hideaki Yoshifuji <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>
Subject: Re: [PATCH] IPv6: add option to use Subnet-Router anycast addresses
 as source addresses

Hello.

On 02-01-2014 13:51, Francois-Xavier Le Bail wrote:

> This change allows to follow a recommandation of RFC4942.

> - Add "enable_anycast_src" sysctl to control the use of Subnet-Router anycast
>    addresses as source addresses. This sysctl is false by default to preserve
>    existing behavior.
> - Use it in ip6_datagram_send_ctl() and icmpv6_echo_reply().

> Reference:
> RFC4942 - IPv6 Transition/Coexistence Security Considerations
>     (http://tools.ietf.org/html/rfc4942#section-2.1.6)

> 2.1.6. Anycast Traffic Identification and Security
>
>     [...]
>     To avoid exposing knowledge about the internal structure of the
>     network, it is recommended that anycast servers now take advantage of
>     the ability to return responses with the anycast address as the
>     source address if possible.

> Signed-off-by: Francois-Xavier Le Bail <fx.lebail@...oo.com>
> ---
[...]
> diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
> index 6983058..c7d6392 100644
> --- a/net/ipv6/datagram.c
> +++ b/net/ipv6/datagram.c
> @@ -668,6 +668,9 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
>   			if (addr_type != IPV6_ADDR_ANY) {
>   				int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
>   				if (!(inet_sk(sk)->freebind || inet_sk(sk)->transparent) &&
> +					!(net->ipv6.enable_anycast_src &&
> +					  ipv6_chk_acast_addr(net, NULL,
> +						&src_info->ipi6_addr)) &&

    The continuation line should start right under 'net' on the previous line.

WBR, Sergei

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html