Re: Adding AF_VSOCK to getaddrinfo(3)

[Stefan Hajnoczi <stefanha at redhat dot com>]

On Wed, Aug 19, 2015 at 03:51:05PM +0200, Florian Weimer wrote:
> On 08/14/2015 04:44 PM, Stefan Hajnoczi wrote:
> 
> > Represent AF_VSOCK <uint32_t cid, uint32_t port> addresses textually as
> > node "[vsock:<cid>]" and service "<port>".  For example, cid 2 and port
> > 80
> > is written as node "[vsock:2]" and service "80".
> > 
> > This is close to the IPv6 notation but not a valid IPv6 address, so it's
> > possible to extend address parsing code to handle the AF_VSOCK case.
> 
> What's your use case for this functionality?
> 
> How transparent do you want to the implementation to be?  Returning
> AF_VSOCK addresses for AF_UNSPEC queries would give instant AF_VSOCK
> support to many applications, but could also have unforseen security
> consequences.

Yes, AF_UNSPEC is exactly the case I'd like to support.

By extending getaddrinfo(3) to parse vsock addresses, existing utilities
like wget, netcat, etc can be used over vsock with no changes or minimal
changes.

An example is NFS over vsock.  The nfs-utils userspace tools
mount.nfs(8) program uses getaddrinfo(3) with AF_UNSPEC to resolve a
hostname string to a sockaddr.  It should be possible to say "mount.nfs
[vsock:2]:/export /mnt" and it would work just like it does for IPv4 and
IPv6 today.

Can you elaborate on the security concerns?

Thanks,
Stefan

Attachment: pgptJVXryvEUH.pgp
Description: PGP signature