Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c1cf8422 authored by Stephen Hemminger's avatar Stephen Hemminger Committed by David S. Miller
Browse files

ip: add loose reverse path filtering 

Extend existing reverse path filter option to allow strict or loose
filtering. (See http://en.wikipedia.org/wiki/Reverse_path_filtering

).

For compatibility with existing usage, the value 1 is chosen for strict mode
and 2 for loose mode.

Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6dac62d3

Documentation/networking/ip-sysctl.txt

+15 −9
Original line number Diff line number Diff line
@@ -699,16 +699,22 @@ accept_source_route - BOOLEAN 
	default TRUE (router)

		FALSE (host)



rp_filter - BOOLEAN

	1 - do source validation by reversed path, as specified in RFC1812

	    Recommended option for single homed hosts and stub network

	    routers. Could cause troubles for complicated (not loop free)

	    networks running a slow unreliable protocol (sort of RIP),

	    or using static routes.



rp_filter - INTEGER

	0 - No source validation.



	conf/all/rp_filter must also be set to TRUE to do source validation

	1 - Strict mode as defined in RFC3704 Strict Reverse Path

	    Each incoming packet is tested against the FIB and if the interface

	    is not the best reverse path the packet check will fail.

	    By default failed packets are discarded.

	2 - Loose mode as defined in RFC3704 Loose Reverse Path

	    Each incoming packet's source address is also tested against the FIB

	    and if the source address is not reachable via any interface

	    the packet check will fail.



        Current recommended practice in RFC3704 is to enable strict mode

	to prevent IP spoofin from DDos attacks. If using asymmetric routing

        or other complicated routing,t hen loose mode is recommended.



	conf/all/rp_filter must also be set to non-zero to do source validation

	on the interface



	Default value is 0. Note that some distributions enable it

net/ipv4/fib_frontend.c

+1 −1
Original line number Diff line number Diff line
@@ -275,7 +275,7 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif, 
	fib_res_put(&res);

	if (no_addr)

		goto last_resort;

	if (rpf)

	if (rpf == 1)

		goto e_inval;

	fl.oif = dev->ifindex;