lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <642d0eef-4f62-f63c-9db5-3d890bb942df@miraclelinux.com> Date: Mon, 15 Aug 2016 16:39:51 +0900 From: YOSHIFUJI Hideaki <hideaki.yoshifuji@...aclelinux.com> To: Lorenzo Colitti <lorenzo@...gle.com> Cc: hideaki.yoshifuji@...aclelinux.com, David Ahern <dsa@...ulusnetworks.com>, Erik Kline <ek@...gle.com>, David Miller <davem@...emloft.net>, netdev <netdev@...r.kernel.org>, Hannes Frederic Sowa <hannes@...essinduktion.org> Subject: Re: [PATCH net] net: ipv6: Fix ping to link-local addresses. Lorenzo Colitti wrote: > On Wed, Aug 10, 2016 at 7:44 AM, YOSHIFUJI Hideaki > <hideaki.yoshifuji@...aclelinux.com> wrote: >> >>>> I could see a point of view that says when bound_if is in play sending >>>> to destinations on/via other interfaces--by any mechanism--should >>>> effectively get ENETUNREACH (or something). >>> >>> VRF uses this capability to send on an enslaved interface. ie., socket is bound to VRF device to limit packets to that L3 domain and then uses PKTINFO to force a packet out a particular interface. >> >> We could extend our code to allow enslave devices, maybe. > > So something like this, then? > > static inline bool inet_check_bound_oif(const struct sock *sk, int oif) > { > if (!oif || !sk->sk_bound_dev_if || oif == sk->sk_bound_dev_if) > return true; > > #ifdef CONFIG_NET_L3_MASTER_DEV > return l3mdev_master_ifindex_by_index(sock_net(sk), oif) == > sk->sk_bound_dev_if; > #endif > > return false; > } > > and then in the various sendmsg functions: > > if (!inet_check_bound_oif(sk, oif)) > return -EINVAL; > Yes, something like that. --yoshfuji
Powered by blists - more mailing lists