netdev - Re: [PATCH net] ipv4: add support for "gratuitous" redirect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 29 Sep 2015 11:49:21 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	pabeni@...hat.com
Cc:	netdev@...r.kernel.org, kuznet@....inr.ac.ru, jmorris@...ei.org,
	yoshfuji@...ux-ipv6.org, corbet@....net, kaber@...sh.net
Subject: Re: [PATCH net] ipv4: add support for "gratuitous" redirect

From: Paolo Abeni <pabeni@...hat.com>
Date: Fri, 25 Sep 2015 15:16:58 +0200

> Such hosts are going to silently discard the ICMP redirect
> messages generated by the VRRP router since the message's source
> IP will differ from the redirected route's gateway.
> 
> RFC1122 don't imposes the above check, so this patch makes
 ...

I don't know if it's a question of terminology but RFC1122 does
seem to ask us to make this check, from 3.2.2.2:

	A Redirect message SHOULD be silently discarded if ... the
        source of the Redirect is not the current first-hop gateway
        for the specified destination (see Section 3.3.1).

And that seems to be exactly what this "rt->rt_gateway != old_gw" test
is implementing.

Furthermore, from a completely pragmatic perspective, pushing this
looser requirement down into the hosts is going to be a deployment
nightmare.

Whereas if we changed the routers to send ICMP redirects that these
hosts would actually accept, you'd only have to make the change on
the routers.  This is several orders of magnitude easier to deploy.

So I'm not going to apply this, sorry.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html