Re: rp_filter

[Stephen Frost <sfrost@snowman.net>]

[-- Attachment #1: Type: text/plain, Size: 1348 bytes --]

* Patrick Schaaf (bof@bof.de) wrote:
> Stephen,
> 
> >   Can we *please* move the rp_filter cruft into the firewalling code
> >   proper?
> 
> If that's not a joke, please take your cruisade to the linux-net mailing
> list. It is not up to netfilter / iptables developers to even think
> about removal of base network stack features, in my opinion. Convince
> Dave Miller and Alexey Kusnetsov (speling probably wrong, sorry).
> 
> I'll refrain from speaking against the idea itself, here.

If we had the functionality in netfilter to do what rp_filter does now I
think it'd make for a much better case to get rid of it as it exists.
For that I think we'd need a match target that checked source IP and
incoming interface and compared it against the routing table.  Not
something I'd expect to be very difficult...

I'll see about bringing it up on the linux-net list if this seems like a
reasonable thing to add to netfilter.  I certainly agree about one of
the problems with rp_filter being that it's not noisy about things it
drops (by default at least, I think there may be an option to turn on
logging of it).  It would seem reasonable to me to have the parts of the
kernel that drop packets following some administrative rule be under the
firewalling framework instead of elsewhere throughout the kernel.

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]