IP options on sockets (was Digest V1 #311)

["Ryan Russell" <Ryan.Russell () sybase com>]

> > Those types of things get stripped off before the daemon gets
> > the data, no?  Doesn't all the interesting info below layer 4 get
> > "eaten" by the OS by the time an app using sockets gets
> > it?

> That is not accurate, if a minimun amount of care is taken while
> coding the proxies, connections with source routing can be shut down
> at the application level (as an addition to the OS configration settings).
(code sample snipped)

Ok, I'm wrong on both counts.  FW-1 can block source-routed
packets without the hlp of the OS, and berkeley-style sockets
can block source routing on a per-app basis, on at least OpenBSD
and Linux.  One assume the other BSDs as well.  I do appreciate
people correcting me, though.  I get to learn that way.

So, now I have a question.  Obviously, I don't know a great amount
about Unix socket programming, but I know something about networking,
and I'm confused.

I'm familiar with setting certain options when requesting an outgoing
socket.  I can even see requesting options when receving.  My concept
of a socket is that the settings are for the entire connection, and that
sockets are a stream abstract (at least for TCP) that hide the details
about which bytes showed up in which packet.

So how does the OpenBSD named tell if a packet showed up
with source-routing on?  Do the socket options in the example
code I snipped apply for any packet that "belongs" to that
connection?  I.e. if one single packet in the middle of the connection
shows up with source-routing on, will it get dropped?

Of course, the original idea that started the thread was that
the OS needs to be able to block *any* source routed
packet.  I suppose there may be a need at times for
some apps to allow source-routing, and some not
(for feature reasons... not for security reasons.)  In
general though, if you're going to turn it off, I think
it would be best done at the kernel.

You want one central opportunity to screw it up, and
not an opportunity per application.

                    Ryan