| Message ID | 1235142193.2351.41.camel@localhost.localdomain |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Jesper Dangaard Brouer <jdb@comx.dk> Date: Fri, 20 Feb 2009 16:03:13 +0100 > Author: Jesper Dangaard Brouer <hawk@comx.dk> > Date: Fri Feb 20 15:20:57 2009 +0100 > > Doc: Fix rp_filter description in net/ipv4/Kconfig. > > The reverse path filter (rp_filter) will NOT get enabled > when enabling forwarding. Read the code and tested in > in practice. > > Most distributions does enable it in startup scripts. > > Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Applied, thanks Jesper. Could you write a follow-on patch that accounts for the change Stephen just made in net-next-2.6 which allows strong vs. weak rp filtering? Thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig index 691268f..10c944d 100644 --- a/net/ipv4/Kconfig +++ b/net/ipv4/Kconfig @@ -35,7 +35,7 @@ config IP_ADVANCED_ROUTER at boot time after the /proc file system has been mounted. - If you turn on IP forwarding, you will also get the rp_filter, which + If you turn on IP forwarding, you should consider the rp_filter, which automatically rejects incoming packets if the routing table entry for their source address doesn't match the network interface they're arriving on. This has security advantages because it prevents the @@ -46,9 +46,11 @@ config IP_ADVANCED_ROUTER rp_filter on use: echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter - or + and echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter + Note that some distributions enable it in startup scripts. + If unsure, say N here. choice
Author: Jesper Dangaard Brouer <hawk@comx.dk> Date: Fri Feb 20 15:20:57 2009 +0100 Doc: Fix rp_filter description in net/ipv4/Kconfig. The reverse path filter (rp_filter) will NOT get enabled when enabling forwarding. Read the code and tested in in practice. Most distributions does enable it in startup scripts. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html