Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Andrey Savochkin]

Hi,

On Fri, Sep 07, 2001 at 10:10:01AM +0000, Julian Anastasov wrote:
> 
> Andrey Savochkin wrote:
> 
> > > > connect a datagram socket (which won't produce any actual traffic) to
> > > > the remote host with INADDR_ANY as the local address, and then query
> > > > the local address.  If the local address is the same as the remote
> > > > address, the address is local.
> > >
> > > That will always work, even when you have multiple ethernet
> > > interfaces??
> >
> > It will work almost always, except cases where administrator set different
> > preffered sources in local routes.
> 
> 	It seems if connect() is called without bind() and the target
> is local address the selected source is the same (the preferred address
> is not used). The postfix guys simply can try this proposal (I don't

I've just checked, you're right.
In the mainstream 2.4 kernels for local routes setting the source to be equal
to the target overrides the preferred source from the route.

I personally consider it as a bug.
Why do we have preferred source field in the routes if not to override how
the kernel selects the source by itself?

	Andrey

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Andrey Savochkin]

On Fri, Sep 07, 2001 at 11:09:57AM +0000, Julian Anastasov wrote:
> 
> On Fri, 7 Sep 2001, Andrey Savochkin wrote:
> 
> > > 	It seems if connect() is called without bind() and the target
> > > is local address the selected source is the same (the preferred address
> > > is not used). The postfix guys simply can try this proposal (I don't
> >
> > I've just checked, you're right.
> > In the mainstream 2.4 kernels for local routes setting the source to be equal
> > to the target overrides the preferred source from the route.
> 
> 	I saw it in the 2.2 sources, so it is the same there.
> 
> > I personally consider it as a bug.
> 
> 	Agreed. OTOH, nobody plays with the preferred source in the
> local table. Now the question is whether this is a bug or a feature :)
> In any case, if the admins don't play with the prefsrc in table local
> the above assumption about connecting to local address still works
> for IP/32 (but not for targets in the 127/8 range different from

In my opinion, the priorities in address selection should be the following:
 1. always use prefsrc if it is specified
 2. then for local routes, use destination
 3. as a last resort, call that function guessing the address...

> 127.0.0.1). Hm, may be then a bind() call to the same IP will be required
> before connecting? If bind fails, then the address is not local. If
> not, connect() should succeed and getsockname should return the same
> IP (the preferred source will not be considered in this case from
> the kernel).

I would say that using of bound sockets is a bit risky.
I'm not sure whether such a connect may succeed with 2.2 kernels and
transparent proxy support, for example.

An unbound UDP connect, as autofs does, is a good solution if the mistakes are
acceptable.
The behavior of autofs in case of a mistake, as Peter explained, looks
reasonable and acceptable for me.

Using GETROUTE as Andi suggested is the other good alternative.
But it won't work without NETLINK socket support compiled in.

	Andrey

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Julian Anastasov]

	Hello,

Andrey Savochkin wrote:

> > > connect a datagram socket (which won't produce any actual traffic) to
> > > the remote host with INADDR_ANY as the local address, and then query
> > > the local address.  If the local address is the same as the remote
> > > address, the address is local.
> >
> > That will always work, even when you have multiple ethernet
> > interfaces??
>
> It will work almost always, except cases where administrator set different
> preffered sources in local routes.

	It seems if connect() is called without bind() and the target
is local address the selected source is the same (the preferred address
is not used). The postfix guys simply can try this proposal (I don't
know whether they tried it already). I don't expect netfilter to make
loops by connecting the both ends on same host, so such solution can
return the best actual result that is possible at the time of the request.
Any assumptions on daemon start what are the local IP addresses can be
wrong for some strange setups.

	May be someone can check whether this is a portable way to
check whether one IP is local. [We know that bind() to IP is not such
solution, at least in Linux]. If this is true, I think, it is better than
using ioctls or talking rtnetlink.

	As for the "local networks" there is no such thing. There are
trusted and non-trusted networks, gatewayed and non-gatewayed, etc. So, it
should be a user-defined setting, if used somehow at all.

> I.e. it is indeed a very good approximation, but autofs shouldn't still hang
> or do nasty things if the check with the datagram socket shows that address
> isn't local, but in reality it happens to be local.
> A subtle misbehavior or loss of efficiency are acceptable, in my opinion.

Regards

--
Julian Anastasov <ja@ssi.bg>

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Julian Anastasov]

	Hello,

On Fri, 7 Sep 2001, Andrey Savochkin wrote:

> > 	It seems if connect() is called without bind() and the target
> > is local address the selected source is the same (the preferred address
> > is not used). The postfix guys simply can try this proposal (I don't
>
> I've just checked, you're right.
> In the mainstream 2.4 kernels for local routes setting the source to be equal
> to the target overrides the preferred source from the route.

	I saw it in the 2.2 sources, so it is the same there.

> I personally consider it as a bug.

	Agreed. OTOH, nobody plays with the preferred source in the
local table. Now the question is whether this is a bug or a feature :)
In any case, if the admins don't play with the prefsrc in table local
the above assumption about connecting to local address still works
for IP/32 (but not for targets in the 127/8 range different from
127.0.0.1). Hm, may be then a bind() call to the same IP will be required
before connecting? If bind fails, then the address is not local. If
not, connect() should succeed and getsockname should return the same
IP (the preferred source will not be considered in this case from
the kernel).

> Why do we have preferred source field in the routes if not to override how
> the kernel selects the source by itself?
>
> 	Andrey

Regards

--
Julian Anastasov <ja@ssi.bg>

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Julian Anastasov]

	Hello,

On Fri, 7 Sep 2001, Andrey Savochkin wrote:

> In my opinion, the priorities in address selection should be the following:
>  1. always use prefsrc if it is specified
>  2. then for local routes, use destination
>  3. as a last resort, call that function guessing the address...

	So, you mean such change:

	if (!key.src)
		key.src = key.dst;
with
	if (!key.src)
		key.src = res.fi->fib_prefsrc ?: key.dst;

	key.dst is != 0, so, we don't need to call FIB_RES_PREFSRC
and inet_select_addr, we prefer key.dst as source.

> > 127.0.0.1). Hm, may be then a bind() call to the same IP will be required
> > before connecting? If bind fails, then the address is not local. If
> > not, connect() should succeed and getsockname should return the same
> > IP (the preferred source will not be considered in this case from
> > the kernel).
>
> I would say that using of bound sockets is a bit risky.
> I'm not sure whether such a connect may succeed with 2.2 kernels and
> transparent proxy support, for example.

	Oh, yes, the tproxy ... the connect call should be without bind,
so this soulution is not entirely perfect when "local networks" are
used (on lo) or when the above feature is considered a bug. Agreed for
the next part of the mail... Hm, time to go to netdev

> 	Andrey

Regards

--
Julian Anastasov <ja@ssi.bg>

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Christopher Friesen]

Andrey Savochkin wrote:

> Using GETROUTE as Andi suggested is the other good alternative.
> But it won't work without NETLINK socket support compiled in.

If netlink isn't compiled in, "ip" won't work, true?

And if all they are using is "ifconfig", then SIOCGIFNETMASK should work,
because they will be forced to used the "ethx:y" alias syntax so the names will
be different.

Am I missing something?

Chris

-- 
Chris Friesen                    | MailStop: 043/33/F10  
Nortel Networks                  | work: (613) 765-0557
3500 Carling Avenue              | fax:  (613) 765-2986
Nepean, ON K2H 8E9 Canada        | email: cfriesen@nortelnetworks.com

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Ben Greear]

"H. Peter Anvin" wrote:
> 
> Ben Greear wrote:
> >
> > That will always work, even when you have multiple ethernet
> > interfaces??
> >
> 
> It better.  Otherwise you'd have the machine sending packets out one
> interface and in the other, and the two networks might not even be
> connected...
> 
>         -hpa

This is actually quite easy to have happen unless you turn on
arp-filter.  Put both interfaces on the same network and funny
things happen (pkts go in one IF, and out the other...).  Now,
you could probably argue that for such advanced (or broken)
networks, the user has to just be more careful/specific.  I don't
know about the details for this specific issue, but so long as
the tool(s) allow (even if it's a PITA) one to force the
configuration to happen correctly, then it's no big deal...

Ben

-- 
Ben Greear <greearb@candelatech.com>          <Ben_Greear@excite.com>
President of Candela Technologies Inc      http://www.candelatech.com
ScryMUD:  http://scry.wanfear.com     http://scry.wanfear.com/~greear

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Andrey Savochkin]

On Thu, Sep 06, 2001 at 10:48:54PM -0700, Ben Greear wrote:
> "H. Peter Anvin" wrote:
> 
> > In autofs, I use the following technique to determine if the IP number
> > for a host is local (and therefore vfsbinds can be used rather than
> > NFS mounts):
> > 
> > connect a datagram socket (which won't produce any actual traffic) to
> > the remote host with INADDR_ANY as the local address, and then query
> > the local address.  If the local address is the same as the remote
> > address, the address is local.
> 
> That will always work, even when you have multiple ethernet
> interfaces??

It will work almost always, except cases where administrator set different
preffered sources in local routes.
I.e. it is indeed a very good approximation, but autofs shouldn't still hang
or do nasty things if the check with the datagram socket shows that address
isn't local, but in reality it happens to be local.
A subtle misbehavior or loss of efficiency are acceptable, in my opinion.

Theoretically, it might be possible to create a configuration which gives
false positive in this check, but I can't see how it may be harmful...

	Andrey

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[H. Peter Anvin]

Andrey Savochkin wrote:
> 
> It will work almost always, except cases where administrator set different
> preffered sources in local routes.
> I.e. it is indeed a very good approximation, but autofs shouldn't still hang
> or do nasty things if the check with the datagram socket shows that address
> isn't local, but in reality it happens to be local.
> A subtle misbehavior or loss of efficiency are acceptable, in my opinion.
> 
> Theoretically, it might be possible to create a configuration which gives
> false positive in this check, but I can't see how it may be harmful...
> 

If the check gives a false negative, autofs will create an NFS mount 
even though it's a local file (which may fail if the filesystem isn't 
exported, and is definitely slower.)

If the check gives a false positive, it will try a local bind (and 
probably fail) even though it is a remote filesystem.

	-hpa

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[H. Peter Anvin]

Ben Greear wrote:
> 
> That will always work, even when you have multiple ethernet
> interfaces??
> 

It better.  Otherwise you'd have the machine sending packets out one 
interface and in the other, and the two networks might not even be 
connected...

	-hpa

Re: notion of a local address [was: Re: ioctl SIOCGIFNETMASK: ip aliasbug 2.4.9 and 2.2.19]

[Ben Greear]

"H. Peter Anvin" wrote:

> In autofs, I use the following technique to determine if the IP number
> for a host is local (and therefore vfsbinds can be used rather than
> NFS mounts):
> 
> connect a datagram socket (which won't produce any actual traffic) to
> the remote host with INADDR_ANY as the local address, and then query
> the local address.  If the local address is the same as the remote
> address, the address is local.

That will always work, even when you have multiple ethernet
interfaces??

Ben

-- 
Ben Greear <greearb@candelatech.com>          <Ben_Greear@excite.com>
President of Candela Technologies Inc      http://www.candelatech.com
ScryMUD:  http://scry.wanfear.com     http://scry.wanfear.com/~greear