lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:	Sat, 11 Jan 2014 15:26:59 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	Alexey Kuznetsov <kuznet@....inr.ac.ru>
Cc:	Fran├žois-Xavier Le Bail <fx.lebail@...oo.com>,
	netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	James Morris <jmorris@...ei.org>,
	Hideaki Yoshifuji <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>
Subject: Re: [PATCH net-next] IPv6: enable TCP to use an anycast address

Hi!

On Sat, Jan 11, 2014 at 05:38:27PM +0400, Alexey Kuznetsov wrote:
> On Sat, Jan 11, 2014 at 5:06 PM, Fran├žois-Xavier Le Bail
> <fx.lebail@...oo.com> wrote:
> > Many DNS root-servers use TCP with anycast (IPv4 and IPV6).
> >
> > see : http://tools.ietf.org/html/draft-jabley-dnsop-anycast-mapping-04#section-4
> >
> > "   L-Root service is provided using a single IPv4 address (199.7.83.42)
> >    and a single IPv6 address (2001:500:3::42).  It should be noted that
> >    it is preferable to refer to the service using its DNS name (L.ROOT-
> >    SERVERS.NET) rather than literal addresses, since addresses can
> >    change from time to time."
> 
> Is this all? It looks like this implies routing by deep packet inspection,
> fetching some creepy node identification options from inside DNS payload
> (not written directly, but  implied). This smells funky.
> 
> Actually, I was alerted by reset processing in your patch, it cannot be right.
> 
> Do not you think this must not be enabled for common use? At least
> some separate sysctl disabled by default.

RFC 4291 - IP Version 6 Addressing Architecture started to allow the use of
anycast addresses as source addresses.

This would be great to have DNS servers listening on them but they need to
respond to both, UDP and TCP.

The idea I had, was, that if a socket does knowingly bind to an anycast
address, it is allowed to do so and process queries on it with both TCP and
UDP. I don't think we need a sysctl for that? Anycast addresses are either
pre-defined (e.g. the subnet router anycast address) or specified by a flag
when the administrator adds one. Currently one can only add anycast addresses
either by forwarding and gets the per-subnet anycast address or with a
setsockopt IPV6_JOIN_ANYCAST.

So the problem is what should be allowed when the socket listens on an any
address? Maybe this should be protected by a sysctl?

Greetings,

  Hannes

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists