From owner-freebsd-bugs Thu Nov 15 12:30:11 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id DA4D237B41A for ; Thu, 15 Nov 2001 12:30:01 -0800 (PST) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.4/8.11.4) id fAFKU1X58552; Thu, 15 Nov 2001 12:30:01 -0800 (PST) (envelope-from gnats) Date: Thu, 15 Nov 2001 12:30:01 -0800 (PST) Message-Id: <200111152030.fAFKU1X58552@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: "Crist J. Clark" Subject: Re: kern/31891: Change mask of loopback net breaks compatibility with older versions Reply-To: "Crist J. Clark" Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org The following reply was made to PR kern/31891; it has been noted by GNATS. From: "Crist J. Clark" To: .@babolo.ru Cc: FreeBSD-gnats-submit@FreeBSD.ORG Subject: Re: kern/31891: Change mask of loopback net breaks compatibility with older versions Date: Thu, 15 Nov 2001 12:23:51 -0800 On Thu, Nov 15, 2001 at 07:23:11PM +0300, .@babolo.ru wrote: > Crist J. Clark writes: > > On Sat, Nov 10, 2001 at 07:11:26AM +0300, .@babolo.ru wrote: > > [snip] > > > > > >Description: > > > > > > There was 4.2 RELEASE, where packets with 127.0.0.0/24 source address > > > droped on input interfaces. Now it changed to 127.0.0.0/8, > > > which is incombatible with old configuration. > > > This net - 127.0.0.0/8 is extremly useful > > > as private net in clustering environment, > > > so I propose configuration variable MYLOOP_MASKLEN, > > > with default meaning that conforms RFC1122 > > > > > > >How-To-Repeat: > > > > > > Try P2P addresses in 127.0.0.0/8 net. > > > > This is a feature, not a bug. See RFC1122, "Requirements for Internet > > Hosts," > > > > (g) { 127, } > > > > Internal host loopback address. Addresses of this form > > MUST NOT appear outside a host. > > > > The 127/8 is never valid when coming from another host. > > > > Do not use 127/8 as a private network, that's what RFC1918 addresses > > are for. > OK. > Lets it be feature. > Consider please case where more then one > kernel looks for outside world as one entity. > May be name "cluster" is good enough in this case. > There no protection beetween kernels in such > environment and use of 127.X nets for interface > inside cluster somehow protects from outside world. Using 127/8 affords no more "protection" from the outside world than using an RFC1918 network. None of those networks is routed on the Internet-at-large. Of course, none of that will protect you from source routing. For a cluster as you describe, I would recommend a firewall or better yet, disconnection from public networks. But in any case, the Internet Standard is clear. 127/8 packets must not ever be seen outside of a host. You should never see those crossing a physical interface. It makes even less sense to treat 127/24 or some subnet of 127/8 like this, but not 127/8 as a whole. Of course, you can feel free to break any standards you wish on your own network (but don't complain too much when things stop working); you already have the patches to do so. But I don't think there is any desire to incorporate them into the base FreeBSD IP stack. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message