| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <874mbct95a.fsf@nemi.mork.no>
Date: Fri, 08 Apr 2016 17:25:37 +0200
From: Bjørn Mork <bjorn@...k.no>
To: Hannes Frederic Sowa <hannes@...essinduktion.org>
Cc: Daniel Borkmann <daniel@...earbox.net>, davem@...emloft.net,
robbat2@...too.org, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] ipv6, token: allow for clearing the current device token
Hannes Frederic Sowa <hannes@...essinduktion.org> writes:
> On Fri, Apr 8, 2016, at 16:18, Bjørn Mork wrote:
>> Daniel Borkmann <daniel@...earbox.net> writes:
>>
>> >
>> > if (!token)
>> > return -EINVAL;
>> > - if (ipv6_addr_any(token))
>> > - return -EINVAL;
>> > if (dev->flags & (IFF_LOOPBACK | IFF_NOARP))
>> > return -EINVAL;
>>
>> Not directly related to the patch in question. It just made me aware of
>> this restriction...
>>
>> I realize that I'm a few years late here, but what's with the IFF_NOARP?
>> Is that just because we can't do DAD for the token based addresses? How
>> is that different from manually configuring the whole address?
>
> IFF_NOARP is kind of the equivalent to no neighbor discovery. If you set
> a token and never get in a router advertisement you never create a
> tokenized ip address, thus the feature is useless.
You can get router advertisements with IFF_NOARP. You cannot lookup L2
addresses, but the L3 prefix info is still as useful as with any other
interface.
Doing
tshark -nVi any -f ip6
while bringing up the POINTOPOINT NOARP interface shown at the end shows
the expected RS and RA:
Frame 1: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
Interface id: 0 (any)
Encapsulation type: Linux cooked-mode capture (25)
Arrival Time: Apr 8, 2016 17:18:36.094554456 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1460128716.094554456 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 64 bytes (512 bits)
Capture Length: 64 bytes (512 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: sll:ethertype:ipv6:icmpv6]
Linux cooked capture
Packet type: Sent by us (4)
Link-layer address type: 65534
Link-layer address length: 0
Protocol: IPv6 (0x86dd)
Internet Protocol Version 6, Src: fe80::8019:47ef:17a1:8c38, Dst: ff02::2
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flowlabel: 0x00000000
Payload length: 8
Next header: ICMPv6 (58)
Hop limit: 255
Source: fe80::8019:47ef:17a1:8c38
Destination: ff02::2
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Internet Control Message Protocol v6
Type: Router Solicitation (133)
Code: 0
Checksum: 0x1155 [correct]
Reserved: 00000000
Frame 2: 120 bytes on wire (960 bits), 120 bytes captured (960 bits) on interface 0
Interface id: 0 (any)
Encapsulation type: Linux cooked-mode capture (25)
Arrival Time: Apr 8, 2016 17:18:36.101806992 CEST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1460128716.101806992 seconds
[Time delta from previous captured frame: 0.007252536 seconds]
[Time delta from previous displayed frame: 0.007252536 seconds]
[Time since reference or first frame: 0.007252536 seconds]
Frame Number: 2
Frame Length: 120 bytes (960 bits)
Capture Length: 120 bytes (960 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: sll:ethertype:ipv6:icmpv6]
Linux cooked capture
Packet type: Unicast to us (0)
Link-layer address type: 65534
Link-layer address length: 0
Protocol: IPv6 (0x86dd)
Internet Protocol Version 6, Src: fe80::a5a6:793:6bfe:ea1c, Dst: fe80::8019:47ef:17a1:8c38
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flowlabel: 0x00000000
Payload length: 64
Next header: ICMPv6 (58)
Hop limit: 255
Source: fe80::a5a6:793:6bfe:ea1c
Destination: fe80::8019:47ef:17a1:8c38
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Internet Control Message Protocol v6
Type: Router Advertisement (134)
Code: 0
Checksum: 0x96fa [correct]
Cur hop limit: 255
Flags: 0x40
0... .... = Managed address configuration: Not set
.1.. .... = Other configuration: Set
..0. .... = Home Agent: Not set
...0 0... = Prf (Default Router Preference): Medium (0)
.... .0.. = Proxy: Not set
.... ..0. = Reserved: 0
Router lifetime (s): 65535
Reachable time (ms): 0
Retrans timer (ms): 0
ICMPv6 Option (Source link-layer address : 02:50:f3:00:01:00)
Type: Source link-layer address (1)
Length: 1 (8 bytes)
Link-layer address: 02:50:f3:00:01:00
ICMPv6 Option (MTU : 1500)
Type: MTU (5)
Length: 1 (8 bytes)
Reserved
MTU: 1500
ICMPv6 Option (Prefix information : 2a02:2121:81:e578::/64)
Type: Prefix information (3)
Length: 4 (32 bytes)
Prefix Length: 64
Flag: 0xc0
1... .... = On-link flag(L): Set
.1.. .... = Autonomous address-configuration flag(A): Set
..0. .... = Router address flag(R): Not set
...0 0000 = Reserved: 0
Valid Lifetime: 4294967295 (Infinity)
Preferred Lifetime: 4294967295 (Infinity)
Reserved
Prefix: 2a02:2121:81:e578::
nemi:/tmp# ifconfig wwan0
wwan0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.135.186.66 P-t-P:10.135.186.66 Mask:255.255.255.252
inet6 addr: 2a02:2121:81:e578:bce:7da1:24a5:af48/64 Scope:Global
inet6 addr: fe80::8019:47ef:17a1:8c38/64 Scope:Link
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:3 errors:0 dropped:0 overruns:0 frame:0
TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:716 (716.0 B) TX bytes:704 (704.0 B)
(the other end is an LTE modem here)
Bjørn
Powered by blists - more mailing lists