Re: Problem: RFC1166 addressing

You are correct sir.   I was just quite surprised to find that it works,
and that I can reassign the 127 network to any interface I like.

tc

                                                                                                                
                    Gerhard Mack                                                                                
                    <gmack@innerfi       To:     [e-mail]                                               
                    re.net>              cc:     [e-mail]                                   
                                         Subject:     Re: Problem:  RFC1166 addressing                          
                    09/16/02 12:25                                                                              
                    PM                                                                                          
                                                                                                                
                                                                                                                

On Mon, 16 Sep 2002 [e-mail] wrote:

> Date: Mon, 16 Sep 2002 11:50:36 -0500
> From: [e-mail]
> To: [e-mail]
> Subject: Problem:  RFC1166 addressing
>
> RFC 1166 states that:
>
>
>  The class A network number 127 is assigned the "loopback"
>          function, that is, a datagram sent by a higher level protocol
>          to a network 127 address should loop back inside the host.  No
>          datagram "sent" to a network 127 address should ever appear on
>          any network anywhere.
>
>  Linux does not enforce this.  I have uncovered some users using this
> function to attempt to circumvent the firewall.  I am able to "create"
127
> network traffic as follows:
>
> Machine 1:   ifconfig eth0:1 127.1.2.3   [ running kernel 2.2.14 ]
>
> Machine 2:   ifconfig eth0:1 127.1.2.4  [ running kernel 2.4.19 ]
>
> Machine 2:  ping 127.1.2.3
>
> Packets move between the hosts.    Also seems to work on Macintosh.

I would call that a bug in the firewall rules.  Depending on the hosts to
behave in such a way as to make life easier for the firewall makes for a
losing proposition.

     Gerhard

--
Gerhard Mack

[e-mail]

<>< As a computer I find your faith in technology amusing.