netdev - Re: [PATCH net-next v2] IPv6: add option to use Subnet-Router anycast addresses as source addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 3 Jan 2014 07:30:41 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	François-Xavier Le Bail <fx.lebail@...oo.com>
Cc:	netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	James Morris <jmorris@...ei.org>,
	Hideaki Yoshifuji <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>
Subject: Re: [PATCH net-next v2] IPv6: add option to use Subnet-Router anycast addresses as source addresses

On Thu, Jan 02, 2014 at 10:19:24PM -0800, François-Xavier Le Bail wrote:
> On Fri, 1/3/14, François-Xavier Le Bail <fx.lebail@...oo.com> wrote:
> 
> --------------------------------------------
>  On Thu, 1/2/14, Hannes Frederic Sowa <hannes@...essinduktion.org> wrote:
>   
> >> Ah, I guess you are hinting at the situation where you
> >> ping
> >> a pre-defined
> >> anycast address and expect back a unicast address for
> >> discovering the unicast
> >> address of a router e.g.? Ok, I see...
>   
> > Exact
> 
> more: 
> Some setup may use a ping to Subnet-Router anycast address and expect a reply to discover a unicast address (not very secure, but ...).
> 
> It is the reason why, I want to keep existing default.

Yep, with pre-defined anycast address I actually meant the subnet router
anycast address. We currently don't need to deal with more than that one:
https://www.iana.org/assignments/ipv6-anycast-addresses/ipv6-anycast-addresses.xhtml

As soon as this patch gets applied, we have to keep the knob stable
in its semantic.  So my proposal would be to change the knob to just
control the behaviour of ping replies and also change its name to reflect
this.

Leave datagram sending with specific anycast address as source just open and
don't protect it with this knob. Would that be a plan?

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html