netdev - Re: [PATCH net-next] IPv6: enable TCP to use an anycast address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 11 Jan 2014 15:26:59 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	Alexey Kuznetsov <kuznet@....inr.ac.ru>
Cc:	François-Xavier Le Bail <fx.lebail@...oo.com>,
	netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	James Morris <jmorris@...ei.org>,
	Hideaki Yoshifuji <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>
Subject: Re: [PATCH net-next] IPv6: enable TCP to use an anycast address

Hi!

On Sat, Jan 11, 2014 at 05:38:27PM +0400, Alexey Kuznetsov wrote:
> On Sat, Jan 11, 2014 at 5:06 PM, François-Xavier Le Bail
> <fx.lebail@...oo.com> wrote:
> > Many DNS root-servers use TCP with anycast (IPv4 and IPV6).
> >
> > see : http://tools.ietf.org/html/draft-jabley-dnsop-anycast-mapping-04#section-4
> >
> > "   L-Root service is provided using a single IPv4 address (199.7.83.42)
> >    and a single IPv6 address (2001:500:3::42).  It should be noted that
> >    it is preferable to refer to the service using its DNS name (L.ROOT-
> >    SERVERS.NET) rather than literal addresses, since addresses can
> >    change from time to time."
> 
> Is this all? It looks like this implies routing by deep packet inspection,
> fetching some creepy node identification options from inside DNS payload
> (not written directly, but  implied). This smells funky.
> 
> Actually, I was alerted by reset processing in your patch, it cannot be right.
> 
> Do not you think this must not be enabled for common use? At least
> some separate sysctl disabled by default.

RFC 4291 - IP Version 6 Addressing Architecture started to allow the use of
anycast addresses as source addresses.

This would be great to have DNS servers listening on them but they need to
respond to both, UDP and TCP.

The idea I had, was, that if a socket does knowingly bind to an anycast
address, it is allowed to do so and process queries on it with both TCP and
UDP. I don't think we need a sysctl for that? Anycast addresses are either
pre-defined (e.g. the subnet router anycast address) or specified by a flag
when the administrator adds one. Currently one can only add anycast addresses
either by forwarding and gets the per-subnet anycast address or with a
setsockopt IPV6_JOIN_ANYCAST.

So the problem is what should be allowed when the socket listens on an any
address? Maybe this should be protected by a sysctl?

Greetings,

  Hannes

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html