Re: [RFC PATCH] ipv6: basic implementation of reverse path filtering

[Eric Dumazet <eric.dumazet@gmail.com>]

Le lundi 06 juin 2011 à 13:34 +0200, Eric Leblond a écrit :
> This patch provides a basic implementation of reverse path filtering
> for IPv6. Functionnality can be activatedor desactivated through an
> rp_filter entry similar to the IPv4 one.
> 
> The functionnality is disabled by default for backward compatibility
> but should be enable on all IPv6 routers/firewalls for security reason.
> 
> This implementation is heavily based on the patch Denis Semmau proposed
> in 2006.
> 
> Signed-off-by: Eric Leblond <eric@regit.org>
> ---
>  include/linux/ipv6.h   |    2 ++
>  include/linux/sysctl.h |    1 +
>  net/ipv6/addrconf.c    |   10 ++++++++++
>  net/ipv6/ip6_output.c  |   32 ++++++++++++++++++++++++++++++++
>  4 files changed, 45 insertions(+), 0 deletions(-)
> 

Hmm, is it matching ipv4 one really ?

vi +855 Documentation/networking/ip-sysctl.txt


rp_filter - INTEGER
        0 - No source validation.
        1 - Strict mode as defined in RFC3704 Strict Reverse Path
            Each incoming packet is tested against the FIB and if the interface
            is not the best reverse path the packet check will fail.
            By default failed packets are discarded.
        2 - Loose mode as defined in RFC3704 Loose Reverse Path
            Each incoming packet's source address is also tested against the FIB
            and if the source address is not reachable via any interface
            the packet check will fail.