From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH conntrack-tools 1/2] conntrackd: restrict multicast reception
Date: Mon, 10 Nov 2025 13:35:55 +0100 [thread overview]
Message-ID: <aRHcK0reHpFVExYi@calendula> (raw)
In-Reply-To: <20251110103531.2158-1-pablo@netfilter.org>
On Mon, Nov 10, 2025 at 11:35:30AM +0100, Pablo Neira Ayuso wrote:
> - For IPv4, bind multicast socket to the address specified by
> IPv4_interface to restrict the interface.
>
> - For IPv6, bind the multicast socket to the IPv6 multicast address.
> Although interface_index6 already restricts the interface, binding to
> inaddr_any still allows for IPv4 sync messages to be received.
>
> Without this patch, multicast sync messages can be received from any
> address if your firewall policy does not restrict the interface used for
> sending and receiving them.
This patch breaks communication between nodes, scratch that.
prev parent reply other threads:[~2025-11-10 12:36 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-10 10:35 [PATCH conntrack-tools 1/2] conntrackd: restrict multicast reception Pablo Neira Ayuso
2025-11-10 10:35 ` [PATCH conntrack-tools 2/2] conntrackd: remove double close() in multicast resulting in EBADFD Pablo Neira Ayuso
2025-11-10 12:35 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aRHcK0reHpFVExYi@calendula \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.