Subject: Re: question about ipf "fastroute"
To: der Mouse <mouse@Rodents.Montreal.QC.CA>
From: Seth Kurtzberg <firstname.lastname@example.org>
Date: 02/13/2003 14:55:25
Do you consider this a security issue? I know that in general source routing
is frowned about by security folks, but I'm not sure if that applies to this
On Thursday 13 February 2003 02:39 pm, der Mouse wrote:
> > I want to do source address based routing for some particular IPs.
> I have a pseudo-interface driver that does exactly this:
> [Truly-Delicious - root] 75> netstat -rn -f inet | egrep srt0
> default 10.0.0.1 UGS 3 468844 1500 srt0
> 10.0.0.1 22.214.171.124 UH 1 0 1500 srt0
> My default route points out an srt interface. The interface is
> configured as
> [Truly-Delicious - root] 76> ifconfig srt0
> srt0: flags=11<UP,POINTOPOINT> mtu 1500
> inet 126.96.36.199 --> 10.0.0.1 netmask 0xffffffff
> [Truly-Delicious - root] 77> srtconfig srt0
> 0: 188.8.131.52 /32 rl0 184.108.40.206
> 1: 220.127.116.11 /32 ppp0 18.104.22.168
> The srtconfig output indicates that packets whose source address is
> 22.214.171.124 are sent out rl0 with next-hop address 126.96.36.199; those
> whose source address is 188.8.131.52 go out ppp0 with next-hop address
> 184.108.40.206. (This is actually outdated; the next-hop address for ppp0
> should be different. The only reason this works is that ppp0 ignores
> the next-hop address.) Packets with other source addresses are
> silently dropped; that machine should not be sending packets with any
> other source addresses down its default route.
> > But, how do I do this with an ethernet?
> Install sys/dev/pseudo/if_srt* from my patch tree? :)
> This assumes it's IPv4. I haven't yet taught it about IPv6.
> /~\ The ASCII der Mouse
> \ / Ribbon Campaign
> X Against HTML email@example.com
> / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
M. I. S. Corp.