| Message ID | 1de8170c1b7dec795f8ca257fbd56c61c36ad5a2.1607050389.git.andreas.a.roeseler@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | add support for RFC 8335 PROBE | expand |
On 12/3/20 8:16 PM, Andreas Roeseler wrote: > Section 8 of RFC 8335 specifies potential security concerns of > responding to PROBE requests, and states that nodes that support PROBE > functionality MUST be able to enable/disable responses and it is > disabled by default. > > Add sysctl to enable responses to PROBE messages. > > Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com> > --- > include/net/netns/ipv4.h | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h > index 8e4fcac4df72..1d9b74228f3e 100644 > --- a/include/net/netns/ipv4.h > +++ b/include/net/netns/ipv4.h > @@ -85,6 +85,7 @@ struct netns_ipv4 { > #endif > > int sysctl_icmp_echo_ignore_all; > + int sysctl_icmp_echo_enable_probe; > int sysctl_icmp_echo_ignore_broadcasts; > int sysctl_icmp_ignore_bogus_error_responses; > int sysctl_icmp_ratelimit; > this can be folded into patch 4; no need for a standalone patch here.
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h index 8e4fcac4df72..1d9b74228f3e 100644 --- a/include/net/netns/ipv4.h +++ b/include/net/netns/ipv4.h @@ -85,6 +85,7 @@ struct netns_ipv4 { #endif int sysctl_icmp_echo_ignore_all; + int sysctl_icmp_echo_enable_probe; int sysctl_icmp_echo_ignore_broadcasts; int sysctl_icmp_ignore_bogus_error_responses; int sysctl_icmp_ratelimit;
Section 8 of RFC 8335 specifies potential security concerns of responding to PROBE requests, and states that nodes that support PROBE functionality MUST be able to enable/disable responses and it is disabled by default. Add sysctl to enable responses to PROBE messages. Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com> --- include/net/netns/ipv4.h | 1 + 1 file changed, 1 insertion(+)