On Thu, Jun 28, 2007 at 08:06:06PM +0200, Matthias Drochner wrote:
> 
> christos@astron.com said:
> > I don't think that this is needed since the v4 sysctl node should be
> > able to handle v6.
> 
> Yes, but since seperate sysctl nodes are created, I assumed
> this was on purpose.
> 
> There is some code in sysctl_net_inet_tcp_ident():
>         pf = name[-3];
> 	[...]
> 	if (pf != sa[0].ss_family [...]
> which enforces that the AF in the sysctl mib matches
> the pf in the socket addresses. It might be sufficient to just
> replace that by something like
> 	pf = sa[0].ss_family

IMO, it is desirable (also, harmless and unsurprising) to enforce this.
We may in the future want to restrict processes to operating on a subset
of the sysctl tree.  If a process may rely on the PF_INET sysctl sub-tree
to kill PF_INET6 sockets, then when I give a process the privilege to
read/write the net.inet.tcp sub-tree, I cannot help but grant it the
privilege to kill both IPv6 and IPv4 connections, which may defeat my
purpose in restricting the privileges of the process.  I am concerned
with running processes with least privileges, you see.

Dave

-- 
David Young             OJC Technologies
dyoung@ojctech.com      Urbana, IL * (217) 278-3933 ext 24