netdev - Re: [PATCH net-next] IPv6: enable TCP to use an anycast address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20140114.151402.1121761875279304938.davem@davemloft.net>
Date:	Tue, 14 Jan 2014 15:14:02 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	hannes@...essinduktion.org
Cc:	fx.lebail@...oo.com, kuznet@....inr.ac.ru, netdev@...r.kernel.org,
	jmorris@...ei.org, yoshfuji@...ux-ipv6.org, kaber@...sh.net
Subject: Re: [PATCH net-next] IPv6: enable TCP to use an anycast address

From: Hannes Frederic Sowa <hannes@...essinduktion.org>
Date: Mon, 13 Jan 2014 02:11:46 +0100

> Hi!
> 
> On Sun, Jan 12, 2014 at 06:53:47AM -0800, François-Xavier Le Bail wrote:
>> On Sat, 1/11/14, Hannes Frederic Sowa <hannes@...essinduktion.org> wrote:
>> 
>> > On Sat, Jan 11, 2014 at 05:38:27PM +0400, Alexey Kuznetsov wrote:
>> > > On Sat, Jan 11, 2014 at 5:06 PM, François-Xavier Le Bail
>> > > <fx.lebail@...oo.com> wrote:
>> > > > Many DNS root-servers use TCP with anycast (IPv4 and IPV6).
>> > > 
>> > > Actually, I was alerted by reset processing in your patch, it cannot be right.
>> > > 
>> > > Do not you think this must not be enabled for common use? At least
>> > > some separate sysctl disabled by default.
>> 
>> > The idea I had, was, that if a socket does knowingly bind to an anycast
>> > address, it is allowed to do so and process queries on it with both TCP and
>> > UDP. I don't think we need a sysctl for that? Anycast addresses are either
>> > pre-defined (e.g. the subnet router anycast address) or specified by a flag
>> > when the administrator adds one. Currently one can only add anycast addresses
>> > either by forwarding and gets the per-subnet anycast address or with a
>> > setsockopt IPV6_JOIN_ANYCAST.
>> 
>> > So the problem is what should be allowed when the socket listens on an any
>> > address? Maybe this should be protected by a sysctl?
>> 
>> TCP case:
>> With my two patches (the one for bind and this one for tcp), when a
>> SOCK_STREAM socket listen to in6addr_any, the server is able to 
>> send TCP reply with unicast or anycast source address, according
>> to the destination address used by the client.
>> 
>> dest request unicast => src reply unicast (current behavior)
>> dest resquet anycast => src reply anycast (new)
>> 
>> So, I don't think there is a need for a sysctl.
> 
> I am still thinking about the RST-case and am a bit unsure here. But I
> currently don't see any problems.

I think this needs much more discussion and analysis before I can really
seriously consider applying this, sorry.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html