lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sun, 10 Jan 2016 00:01:24 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	Robert Sander <r.sander@...nlein-support.de>,
	netfilter@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: Configure ICMP error source address

On 09.01.2016 17:41, Robert Sander wrote:
> Hi,
>
> Am 09.01.2016 um 10:57 schrieb Hannes Frederic Sowa:
>>
>> I would also use dummy interfaces in production systems, merely to split
>> the statistics from dummy.
>
> Thank you for discussing the merits of dummy interfaces. I will consider
> your arguments. But unfortunately this did not answer my question.

Yes, I know. :) I tried to answer it in the other reply.

> Let me rephrase it:
>
> Is it a good idea to set a specific global IPv4 address as source
> address for outgoing ICMP error messages?

Not sure if this generic enough.

So my idea was to have a specific routing table and ip rule you can 
install merely for selecting the source address of an icmp errors.

Not sure yet how complicated that is, it would require a match in the 
rule lookup logic to specifically use another routing table when the 
source address for an icmp packet is generated. We already supply the 
protocol in the flow4 information, maybe this can be used plus another 
input/flag in the flowi4 struct?

I can see situations were it is necessary to actually select the source 
address depending of the interface.

> Would it be OK to create a /proc/sys/net/ipv4/icmp_errors_source where
> you could write an arbitrary IPv4 address into? And that would get used
> as the source address of ICMP errors?
>
> My questions did contain the loopback interface as I first thought it a
> good source of a globally routable IPv4 address (at least in our case).
>
> Secound thought: Instead of writing an IPv4 address to
> /proc/sys/net/ipv4/icmp_errors_source write an interface name to that
> file and take the first global IPv4 address from that interface as
> source for ICMP errors. Then you could create a dummy interface for that
> use case, too.

I am not a fan of such implicit assumptions. I would prefer the direct 
specification of the source ip address over writing interface 
information to a procfs file.

> Still: Is it a good idea to do so?

I agree, there should be a solution for this as this is a common setup 
for BGP routers.

Bye,
Hannes

Powered by blists - more mailing lists