From mboxrd@z Thu Jan 1 00:00:00 1970 From: Hannes Frederic Sowa Subject: Re: [PATCH net-next v5] IPv6: add the option to use anycast addresses as source addresses in echo reply Date: Wed, 8 Jan 2014 00:01:34 +0100 Message-ID: <20140107230134.GK30393@order.stressinduktion.org> References: <1389103047-3380-1-git-send-email-fx.lebail@yahoo.com> <20140107175507.fb543c70.billfink@mindspring.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Cc: Francois-Xavier Le Bail , netdev@vger.kernel.org, "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki Yoshifuji , Patrick McHardy To: Bill Fink Return-path: Received: from order.stressinduktion.org ([87.106.68.36]:46558 "EHLO order.stressinduktion.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750945AbaAGXBg (ORCPT ); Tue, 7 Jan 2014 18:01:36 -0500 Content-Disposition: inline In-Reply-To: <20140107175507.fb543c70.billfink@mindspring.com> Sender: netdev-owner@vger.kernel.org List-ID: On Tue, Jan 07, 2014 at 05:55:07PM -0500, Bill Fink wrote: > On Tue, 7 Jan 2014, Francois-Xavier Le Bail wrote: > > > This change allows to follow a recommandation of RFC4942. > > > > - Add "anycast_src_echo_reply" sysctl to control the use of anycast addresses > > as source addresses for ICMPv6 echo reply. This sysctl is false by default > > to preserve existing behavior. > > - Add inline check ipv6_anycast_destination(). > > - Use them in icmpv6_echo_reply(). > > > > Reference: > > RFC4942 - IPv6 Transition/Coexistence Security Considerations > > (http://tools.ietf.org/html/rfc4942#section-2.1.6) > > > > 2.1.6. Anycast Traffic Identification and Security > > > > [...] > > To avoid exposing knowledge about the internal structure of the > > network, it is recommended that anycast servers now take advantage of > > the ability to return responses with the anycast address as the > > source address if possible. > > > > Signed-off-by: Francois-Xavier Le Bail > > --- > > v4: update Subject and Documentation, this work also with anycast addresses > > created via API, not just with Subnet-Router anycast addresses. > > > > v5: alternative way, replace ipv6_chk_acast_addr() test by > > ipv6_anycast_destination() test. > > Why is ICMPV6 Echo Reply special? Can't the internal structure > of the network be divined from other ICMPv6 responses such as > Destination Unreachable, Time Exceeded (Hop Limit), and Parameter > Problem. No, here destination must match the source address so that the other side handles accordingly when the icmp error is pushed up to the socket layer. Greetings, Hannes