Strong-end vs weak-end host model

[Pau Garcia i Quiles]

Hello,

By default the TCP/IP stack in Linux has a weak-end [1] behavior,
which is causing a lot of trouble for me in a very specific but widely
used scenario here at work. Is it possible to make it strong-end
*without* bridging interfaces? (which is the only way I've found,
here: http://lkml.indiana.edu/hypermail/linux/kernel/0801.3/3174.html
)

[1] in case of server multihomed =85
=93strong-end model=94 =3D refers to the kernel that
accepts packets on an interface only if DST_IP is
equal to the IP of the interface
=93weak-end model=94 =3D refer to the kernel that
accepts packets only if DST_IP is equal to the IP of
any interface of the server

(see slide 12 in http://security.polito.it/~lioy/01jfd/02_Socket_En6x.p=
df)

AFAIK this is possible on Windows since Vista. For now I'm solving the
issue by making sure all the network libraries and applications make
use of SO_BINDTODEVICE but it's a PITA.

Thank you.

--=20
Pau Garcia i Quiles
http://www.elpauer.org
(Due to my workload, I may need 10 days to answer)
--
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

[Pascal Hambourg]

Hello,

Post by Pau Garcia i Quiles
=20
By default the TCP/IP stack in Linux has a weak-end [1] behavior,
which is causing a lot of trouble for me in a very specific but widel=

y

Post by Pau Garcia i Quiles
used scenario here at work. Is it possible to make it strong-end
*without* bridging interfaces? (which is the only way I've found,
here: http://lkml.indiana.edu/hypermail/linux/kernel/0801.3/3174.html
)

Huh ? What does bridging have to do with the host model ?

1) Use iptables filtering rules based on the source/destination address=
=2E
2) If ARP is an issue (should not be for a simple multihomed host), tun=
e
the sysctls net.ipv4.conf.*.arp_{filter,announce,ignore}.
--
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html