From: Patrick McHardy <kaber@trash.net>
To: hadi@cyberus.ca
Cc: KOVACS Krisztian <hidden@sch.bme.hu>,
KOVACS Krisztian <hidden@balabit.hu>,
Andreas Schultz <aschultz@warp10.net>,
tproxy@lists.balabit.hu, netdev@vger.kernel.org
Subject: Re: [tproxy,regression] tproxy broken in 2.6.32
Date: Sat, 28 Nov 2009 18:07:26 +0100 [thread overview]
Message-ID: <4B1158CE.90803@trash.net> (raw)
In-Reply-To: <1259424278.3864.16.camel@bigi>
jamal wrote:
> On Sat, 2009-11-28 at 16:46 +0100, Patrick McHardy wrote:
>
>> The root cause seems to be an invalid assumption, marks are often not
>> used in a symetric fashion as required by RPF.
>
> The only assumption is: if you set set up a mark on incoming, you are
> asking the reverse validation that is to be used to consider that mark.
>
> This has nothing to do with RPF really;-> RPF is off. There is a legit
> bug in the old setup that has a table programmed with a route that is
> not unicast.
Right, its source validation. But the setup is valid, its asking for
specifically marked packets to be delivered locally for transparent
proxying. There's no requirement that rules using marks must resolve
to RTN_UNICAST.
>> Since this patch has already proven to break existing setups, I think
>> it should be reverted or the behaviour made optional with a default to
>> off.
>
> I disagree. What other setup is broken? ;->
Isn't one setup usually considered enough? :)
next prev parent reply other threads:[~2009-11-28 17:07 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <db81a9a20911230443h443b3c2l8fab5aef7b09cfa@mail.gmail.com>
[not found] ` <1259137434.9191.3.camel@nienna.balabit>
2009-11-26 17:19 ` [tproxy,regression] tproxy broken in 2.6.32 Andreas Schultz
2009-11-27 8:26 ` KOVACS Krisztian
2009-11-27 9:11 ` Andreas Schultz
2009-11-27 16:05 ` jamal
2009-11-28 15:15 ` KOVACS Krisztian
2009-11-28 15:45 ` jamal
2009-11-28 18:50 ` KOVACS Krisztian
2009-11-28 19:26 ` jamal
2009-11-28 15:46 ` Patrick McHardy
2009-11-28 16:04 ` jamal
2009-11-28 17:07 ` Patrick McHardy [this message]
2009-11-28 17:36 ` jamal
2009-11-28 19:05 ` KOVACS Krisztian
2009-11-28 19:44 ` jamal
2009-11-28 21:21 ` David Miller
2009-11-28 22:20 ` jamal
2009-11-29 20:35 ` KOVACS Krisztian
2009-11-30 12:15 ` jamal
2009-11-30 12:45 ` KOVACS Krisztian
2009-11-30 13:59 ` jamal
2009-12-01 13:34 ` jamal
2009-12-03 6:31 ` David Miller
2009-12-03 13:53 ` jamal
2009-12-03 13:55 ` Patrick McHardy
2009-12-03 14:07 ` KOVACS Krisztian
2009-12-03 14:29 ` jamal
2009-12-13 16:52 ` [PATCH] net: restore ip source validation WAS(Re: " jamal
2009-12-13 18:12 ` Julian Anastasov
2009-12-13 18:38 ` jamal
2009-12-13 19:11 ` jamal
2009-12-13 19:15 ` jamal
2009-12-14 3:10 ` David Miller
2009-12-14 10:19 ` jamal
2009-12-26 1:30 ` David Miller
2009-12-26 15:05 ` jamal
2009-12-26 21:45 ` David Miller
2009-11-30 20:17 ` David Miller
2009-11-28 21:22 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4B1158CE.90803@trash.net \
--to=kaber@trash.net \
--cc=aschultz@warp10.net \
--cc=hadi@cyberus.ca \
--cc=hidden@balabit.hu \
--cc=hidden@sch.bme.hu \
--cc=netdev@vger.kernel.org \
--cc=tproxy@lists.balabit.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).