netdev - Re: [PATCH net-next] IPv6: add option to use anycast addresses as source addresses in icmp error messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 15 Jan 2014 01:46:03 -0800 (PST)
From:	François-Xavier Le Bail <fx.lebail@...oo.com>
To:	netdev@...r.kernel.org, Bill Fink <billfink@...dspring.com>,
	"David S. Miller" <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	James Morris <jmorris@...ei.org>,
	Hideaki Yoshifuji <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>,
	Hannes Frederic Sowa <hannes@...essinduktion.org>
Subject: Re: [PATCH net-next] IPv6: add option to use anycast addresses as source addresses in icmp error messages

On Tue, Jan 14, 2014 at 02:13:44PM +0100, Hannes Frederic Sowa wrote:
> > On Mon, Jan 13, 2014 at 06:22:44PM +0100, Francois-Xavier Le Bail wrote:
> > > - Add "anycast_src_icmp_error" sysctl to control the use of anycast addresses
> > >   as source addresses for ICMPv6 error messages. This sysctl is false by
> > >   default to preserve existing behavior.
> > > - Use it in icmp6_send().
> > > 
> > > Suggested-by: Bill Fink <billfink@...dspring.com>
> > > Signed-off-by: Francois-Xavier Le Bail <fx.lebail@...oo.com>
> > 
> > Regarding the anycast patches, I contacted someone from IETF.
> > 
> > The number of sysctls needed to get introduced to have all the flexibility
> > regarding source address selection and don't break backward compatibility
> > concerns me a bit.
> > 
> > Especially on end hosts, where those switches will be important, I think we
> > really have to think about sensible defaults without breaking current
> > software.
> > 
> > I currently consider a per-address flag, if those anycast addresses
> > should be available in source address selection (also with an enhancement to
> > current IPV6_JOIN_ANYCAST logic).
> 
> Francois, we should really think about this. Also if we should just
> make the pre-defined subnet address just a normal anycast address in the
> long-term (which just happens to get automatically added to an interface
> if forwarding is enabled) and bundle all the source address selection
> logic on the per-address state.

Hi Hannes,

Please submit patches with your solution, so that we can have a basis
for discussion.

> If that would be the case, we could revert
> 509aba3b0d366b7f16a9a2eebac1156b25f5f622 ("IPv6: add the option to use
> anycast addresses as source addresses in echo reply") and thus would
> eliminate one sysctl.

If your solution achieve the same goal without this sysctl, I agree with you.

> It would be fine if we can make this decision before David merges with
> Linus.  I guess we can still do this decision while in -rc phase. But
> as soon as the knob is in a released version of linux we can never take
> it back (I really don't like sysctls).

Sure.

Cheers,
François-Xavier
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html