From: Andi Kleen <ak@suse.de>
To: Olaf Kirch <okir@caldera.de>
Cc: linux-kernel@vger.kernel.org, security-audit@ferret.lmh.ox.ac.uk
Subject: Re: Traceroute without s bit
Date: Wed, 6 Dec 2000 14:09:05 +0100 [thread overview]
Message-ID: <20001206140905.A408@gruyere.muc.suse.de> (raw)
In-Reply-To: <20001206135019.L9533@monad.caldera.de>
In-Reply-To: <20001206135019.L9533@monad.caldera.de>; from okir@caldera.de on Wed, Dec 06, 2000 at 01:50:19PM +0100
On Wed, Dec 06, 2000 at 01:50:19PM +0100, Olaf Kirch wrote:
> Hi all,
>
> I wrote a small traceroute last night that works mostly like the
> LBL one, except it doesn't need an s bit anymore :)
It already existed in Alexey's iputils (tracepath).
> There are three things that puzzle me, however:
>
> 1. When I want to include IP options into an outgoing packet,
> I'm expected to include a struct ip_options in the IP_RETOPTS
> control message. However, this struct is included in
> #ifdef __KERNEL__/#endif in 2.4.0-t10 (on which I'm compiling
> right now). Normally this doesn't deter me, but in this case
> some of the fields look sort of fishy to me.
>
> My question is, do we really want to allow users to hand
> an arbitrary, unchecked struct ip_options to the kernel?
> Wouldn't raw options be a better choice?
Raw options are passed. That ip_options ever appeared in glibc/user headers
was a bug, it is strictly kernel internal.
>
> 2. There's another issue with ip_cmsg_send in ip_sockglue.c;
> it allows any user to specify PKTINFO data in a control
> messages. As far as I can tell, by looking at udp.c,
> this lets any user set arbitrary IP source addresses
> on outgoing UDP packets. Yikes.
IP_PKTINFO does not allow to set source addresses, only destination
addresses. Source address depends on the boundage or the route.
>
> 3. There seems to be a bug somewhere in the handling of poll().
> If you observe the traceroute process with strace, you'll
> notice that it starts spinning madly after receiving the
> first bunch of packets (those with ttl 1).
>
> 13:43:02 poll([{fd=4, events=POLLERR}], 1, 5) = 0
> 13:43:02 poll([{fd=4, events=POLLERR}], 1, 5) = 0
> 13:43:02 poll([{fd=4, events=POLLERR}], 1, 5) = 0
> 13:43:02 poll([{fd=4, events=POLLERR}], 1, 5) = 0
> ...
>
> I.e. the poll call returns as if it had timed out, but it
> hasn't.
POLLERR is returned until the error queue is empty. I suspect you're
not emptying it properly in all cases. It can contain multiple errors.
-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
next prev parent reply other threads:[~2000-12-06 13:40 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2000-12-06 12:50 Olaf Kirch
2000-12-06 13:09 ` Andi Kleen [this message]
2000-12-06 15:07 ` Olaf Kirch
2000-12-06 16:27 ` Andi Kleen
2000-12-06 15:35 ` James Antill
2000-12-06 16:29 ` Olaf Kirch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20001206140905.A408@gruyere.muc.suse.de \
--to=ak@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=okir@caldera.de \
--cc=security-audit@ferret.lmh.ox.ac.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®