From patchwork Fri Feb 20 15:03:13 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jesper Dangaard Brouer X-Patchwork-Id: 23478 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id A214EDDD1B for ; Sat, 21 Feb 2009 02:03:20 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752198AbZBTPDP (ORCPT ); Fri, 20 Feb 2009 10:03:15 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751905AbZBTPDP (ORCPT ); Fri, 20 Feb 2009 10:03:15 -0500 Received: from lanfw001a.cxnet.dk ([87.72.215.196]:53153 "EHLO lanfw001a.cxnet.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751885AbZBTPDO (ORCPT ); Fri, 20 Feb 2009 10:03:14 -0500 Received: from comxexch02.comx.local (unknown [172.31.1.117]) by lanfw001a.cxnet.dk (Postfix) with ESMTP id 897B6163698; Fri, 20 Feb 2009 16:03:13 +0100 (CET) Received: from 172.31.4.93 ([172.31.4.93]) by comxexch02.comx.local ([172.31.1.117]) with Microsoft Exchange Server HTTP-DAV ; Fri, 20 Feb 2009 15:03:13 +0000 Received: from hawk by comxexch02.comx.local; 20 Feb 2009 16:03:13 +0100 Subject: [PATCH 1/2] Doc: Fix rp_filter description in net/ipv4/Kconfig. From: Jesper Dangaard Brouer Reply-To: jdb@comx.dk To: "David S. Miller" Cc: "netdev@vger.kernel.org" , Kernel Janitors In-Reply-To: <1235141957.2351.37.camel@localhost.localdomain> References: <1235141957.2351.37.camel@localhost.localdomain> Organization: ComX Networks A/S Date: Fri, 20 Feb 2009 16:03:13 +0100 Message-Id: <1235142193.2351.41.camel@localhost.localdomain> Mime-Version: 1.0 X-Mailer: Evolution 2.6.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Author: Jesper Dangaard Brouer Date: Fri Feb 20 15:20:57 2009 +0100 Doc: Fix rp_filter description in net/ipv4/Kconfig. The reverse path filter (rp_filter) will NOT get enabled when enabling forwarding. Read the code and tested in in practice. Most distributions does enable it in startup scripts. Signed-off-by: Jesper Dangaard Brouer --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig index 691268f..10c944d 100644 --- a/net/ipv4/Kconfig +++ b/net/ipv4/Kconfig @@ -35,7 +35,7 @@ config IP_ADVANCED_ROUTER at boot time after the /proc file system has been mounted. - If you turn on IP forwarding, you will also get the rp_filter, which + If you turn on IP forwarding, you should consider the rp_filter, which automatically rejects incoming packets if the routing table entry for their source address doesn't match the network interface they're arriving on. This has security advantages because it prevents the @@ -46,9 +46,11 @@ config IP_ADVANCED_ROUTER rp_filter on use: echo 1 > /proc/sys/net/ipv4/conf//rp_filter - or + and echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter + Note that some distributions enable it in startup scripts. + If unsure, say N here. choice