netdev - RE: Add a SOCK_DESTROY operation to close sockets from userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 18 Nov 2015 11:56:35 +0000
From:	David Laight <David.Laight@...LAB.COM>
To:	'Maciej Zenczykowski' <zenczykowski@...il.com>,
	Stephen Hemminger <stephen@...workplumber.org>
CC:	Lorenzo Colitti <lorenzo@...gle.com>,
	Linux NetDev <netdev@...r.kernel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	"ek@...gle.com" <ek@...gle.com>,
	"dtor@...gle.com" <dtor@...gle.com>
Subject: RE: Add a SOCK_DESTROY operation to close sockets from userspace

From: Maciej Zenczykowski
> Sent: 18 November 2015 03:57
> I don't know what the right fix is...
> 
> However, speaking as an end user with laptops on wifi and/or home
> gateways on dialup connections where the IP address occasionally (or
> constantly) changes, I find it very frustrating that by default as IP
> addresses get removed from interfaces all the related state (whether
> conntrack or open connections) doesn't get cleaned up.

Right, but I don't want it happening when an interface temporarily
goes down for some reason.
Trip over the cable to a USB network interface and you want the connections
to still be alive when you plug it back in.
We've had to put USB interfaces into a 'bond' to get a stable address.

Now, if you have a DHCP assigned address you may want to force a
lease renewal after a network 'glitch'. If you get back a different
address then it might be reasonable for the stack to error any
connections using the old address - after all another system
could be using the old IP address.

I suspect that the only way to avoid horrid timing windows is
to simulate the receipt of RST packets.

	David