[3141] in Kerberos-V5-bugs
krb5-kdc/778: Source address problems with Linux and multiple addresses on an interface
daemon@ATHENA.MIT.EDU (ahp@hilander.com)
Tue Oct 26 20:51:05 1999
Resent-From: gnats@rt-11.MIT.EDU (GNATS Management)
Resent-To: krb5-unassigned@RT-11.MIT.EDU
Resent-Reply-To: krb5-bugs@MIT.EDU, ahp@hilander.com
Message-Id: <E11gHIP-0000RI-00@ramirez.hilander.com>
Date: Wed, 27 Oct 1999 00:50:33 +0000
From: ahp@hilander.com
Reply-To: ahp@hilander.com
To: krb5-bugs@MIT.EDU
>Number: 778
>Category: krb5-kdc
>Synopsis: Source address problem under Linux when multiple interface addresses are present
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: krb5-unassigned
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Tue Oct 26 20:51:00 EDT 1999
>Last-Modified:
>Originator: Alec H. Peterson
>Organization:
Alec H. Peterson - ahp@hilander.com
Staff Scientist
Centergate Research Group - http://www.centergate.com
"Technology so advanced, even we don't understand it."
>Release: krb5-1.0.6
>Environment:
System: Linux ramirez.hilander.com 2.2.12-20 #1 Mon Sep 27 10:25:54 EDT 1999 i586 unknown
Architecture: i586
>Description:
The KDC uses a single socket to handle all incoming UDP requests (well,
one per listening port anyway). This is a problem for machines with
multiple interface addresses, especially with Linux 2.2 kernels. In those
kernels it seems to pick an interface address at random to use (perhaps to
help with load sharing or something). So, when the KDC sends reply packets
it may not be using the same source address as the client was using (for
its destination address).
>How-To-Repeat:
The most reliable way to reproduce it is to put the KDC on a server that
has multiple addresses on an interface and address the server from the
client with one of the 'secondary' addresses on the interface. This
behavior will be most reliably exhibited with a Linux 2.0 kernel, since
it will always source packets from the primary interface address (the
2.2 kernel is more random).
>Fix:
This can be addressed by changing the model to
use listen()/accept() and thus giving the KDC an individual socket for each
client. This may be more cumbersome to manage (more stuff to select() on)
but it would address the problem. I just looked through the sendto()
manpage briefly and there doesn't seem to be an easy way to set the source
address, although I might just be missing something.
>Audit-Trail:
>Unformatted:
