Re: OSDL Bugzilla #2399: A user can remotely route a packet through eth0 on a Li

[Stephen Hemminger <shemminger@xxxxxxxx>]

On Thu, 13 May 2004 12:20:34 -0500
"J. M." <snortwiz@xxxxxxxxxxx> wrote:

> That's exactly what's happening - a service bound to an interface is 
> receiving traffic via a different interface.  That could pose security risks 
> on a dual-homed machine (such as the device I pen-tested and discovered this 
> flaw upon).
> 
> -Jared

On Linux, IP addresses are not bound to interfaces.  You need
to use SO_BINDTODEVICE if that is what you want. 

The security model is correct, and well defined, just different than BSD
derived systems.  It does conform to the standards (RFC's).