On 09.08.2016 10:37, YOSHIFUJI Hideaki wrote: > > > Erik Kline wrote: >> On 9 August 2016 at 14:20, David Miller <da...@davemloft.net> wrote: >>> From: Lorenzo Colitti <lore...@google.com> >>> Date: Tue, 9 Aug 2016 10:00:25 +0900 >>> >>>> Note that pretty much every sendmsg codepath allows other data to take >>>> precedence over sk_bound_dev_if: >>>> >>>> - udpv6_sendmsg: if sin6_scope_id specified on a scoped address >>>> - rawv6_sendmsg: if sin6_scope_id specified on a scoped address >>>> - l2tp_ip6_sendmsg: if sin6_scope_id specified on a scoped address >>>> - ip_cmsg_send: if IP_PKTINFO or IPV6_PKTINFO specified >>>> >>>> What should I do about those? -EINVAL? Ignore the conflicting data? Leave >>>> as is? >>> >>> That's a good point, I guess this needs some more thought. >> >> I could see a point of view that says when bound_if is in play sending >> to destinations on/via other interfaces--by any mechanism--should >> effectively get ENETUNREACH (or something). > > +1 > >> >> That does seem like I would involve changing some existing behavior, though. >> > > The use of sin6_scope_id and SO_BINDTODEVICE with different interfaces > is incorrect and should be rejected.
I agree, I would actually change the behavior at this point, as it also could have security consequences from a network pov. Bye, Hannes
