[PATCH] ip: add loose reverse path filtering

[PATCH] ip: add loose reverse path filtering

[Stephen Hemminger]

Extend existing reverse path filter option to allow strict or loose
filtering. (See http://en.wikipedia.org/wiki/Reverse_path_filtering).

For compatibility with existing usage, the value 1 is chosen for strict mode
and 2 for loose mode.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>

---
 Documentation/networking/ip-sysctl.txt |   22 ++++++++++++++--------
 net/ipv4/fib_frontend.c                |    2 +-
 2 files changed, 15 insertions(+), 9 deletions(-)

--- a/Documentation/networking/ip-sysctl.txt	2009-02-20 10:24:04.128692016 -0800
+++ b/Documentation/networking/ip-sysctl.txt	2009-02-20 10:24:09.733192268 -0800
@@ -699,16 +699,22 @@ accept_source_route - BOOLEAN
 	default TRUE (router)
 		FALSE (host)
 
-rp_filter - BOOLEAN
-	1 - do source validation by reversed path, as specified in RFC1812
-	    Recommended option for single homed hosts and stub network
-	    routers. Could cause troubles for complicated (not loop free)
-	    networks running a slow unreliable protocol (sort of RIP),
-	    or using static routes.
-
+rp_filter - INTEGER
 	0 - No source validation.
+	1 - Strict mode as defined in RFC3704 Strict Reverse Path
+	    Each incoming packet is tested against the FIB and if the interface
+	    is not the best reverse path the packet check will fail.
+	    By default failed packets are discarded.
+	2 - Loose mode as defined in RFC3704 Loose Reverse Path
+	    Each incoming packet's source address is also tested against the FIB
+	    and if the source address is not reachable via any interface
+	    the packet check will fail.
+
+        Current recommended practice in RFC3704 is to enable strict mode
+	to prevent IP spoofin from DDos attacks. If using asymmetric routing
+        or other complicated routing,t hen loose mode is recommended.
 
-	conf/all/rp_filter must also be set to TRUE to do source validation
+	conf/all/rp_filter must also be set to non-zero to do source validation
 	on the interface
 
 	Default value is 0. Note that some distributions enable it
--- a/net/ipv4/fib_frontend.c	2009-02-20 10:24:04.140692744 -0800
+++ b/net/ipv4/fib_frontend.c	2009-02-20 10:24:09.733192268 -0800
@@ -275,7 +275,7 @@ int fib_validate_source(__be32 src, __be
 	fib_res_put(&res);
 	if (no_addr)
 		goto last_resort;
-	if (rpf)
+	if (rpf == 1)
 		goto e_inval;
 	fl.oif = dev->ifindex;
 

Re: [PATCH] ip: add loose reverse path filtering

[Herbert Xu]

Stephen Hemminger <shemminger@vyatta.com> wrote:
> Extend existing reverse path filter option to allow strict or loose
> filtering. (See http://en.wikipedia.org/wiki/Reverse_path_filtering).
> 
> For compatibility with existing usage, the value 1 is chosen for strict mode
> and 2 for loose mode.
> 
> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>

Rather than extending the rp_filter stuff any further, I'd prefer
to see this replaced with netfilter plugin.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] ip: add loose reverse path filtering

[David Miller]

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Sat, 21 Feb 2009 21:09:07 +0800

> Stephen Hemminger <shemminger@vyatta.com> wrote:
> > Extend existing reverse path filter option to allow strict or loose
> > filtering. (See http://en.wikipedia.org/wiki/Reverse_path_filtering).
> > 
> > For compatibility with existing usage, the value 1 is chosen for strict mode
> > and 2 for loose mode.
> > 
> > Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
> 
> Rather than extending the rp_filter stuff any further, I'd prefer
> to see this replaced with netfilter plugin.

Normally I would agree, but in this case the cost is exactly
zero for the added flexibility.

So I'll apply this to net-next-2.6

Re: [PATCH] ip: add loose reverse path filtering

[Herbert Xu]

On Sat, Feb 21, 2009 at 11:56:01PM -0800, David Miller wrote:
>
> > Rather than extending the rp_filter stuff any further, I'd prefer
> > to see this replaced with netfilter plugin.
> 
> Normally I would agree, but in this case the cost is exactly
> zero for the added flexibility.

Ah I thought there was another patch coming :) But obviously as
this is all that's needed for it sure it looks good to me too.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] ip: add loose reverse path filtering

[Stephen Hemminger]

On Sun, 22 Feb 2009 16:34:36 +0800
Herbert Xu <herbert@gondor.apana.org.au> wrote:

> On Sat, Feb 21, 2009 at 11:56:01PM -0800, David Miller wrote:
> >
> > > Rather than extending the rp_filter stuff any further, I'd prefer
> > > to see this replaced with netfilter plugin.
> > 
> > Normally I would agree, but in this case the cost is exactly
> > zero for the added flexibility.
> 
> Ah I thought there was another patch coming :) But obviously as
> this is all that's needed for it sure it looks good to me too.
> 
> Cheers,

Also, the purpose of reverse path filtering is to block Dos attacks.
So it is important to do any rejection with least overhead. If the
filter is iptables rules, it takes longer and requires another route
lookup.