Missing device binding relating to tcp_v4_send_reset?

Missing device binding relating to tcp_v4_send_reset?

[Ben Greear]

This snippet is from some patches Patrick did for me some time
back.  I think the rest of his work has been merged upstream, but
this patch was not.  I'm honestly not sure if it's needed or not,
but we've been running with it for at least a year or so and it's
been working fine for us.


diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 0207662..1af47db 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -641,6 +641,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
  				      arg.iov[0].iov_len, IPPROTO_TCP, 0);
  	arg.csumoffset = offsetof(struct tcphdr, check) / 2;
  	arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
+	arg.bound_dev_if = skb_rtable(skb)->fl.iif;

  	net = dev_net(skb_dst(skb)->dev);
  	ip_send_reply(net->ipv4.tcp_sock, skb,


Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com

Re: Missing device binding relating to tcp_v4_send_reset?

[David Miller]

From: Ben Greear <greearb@candelatech.com>
Date: Mon, 09 Aug 2010 10:46:26 -0700

> This snippet is from some patches Patrick did for me some time
> back.  I think the rest of his work has been merged upstream, but
> this patch was not.  I'm honestly not sure if it's needed or not,
> but we've been running with it for at least a year or so and it's
> been working fine for us.

There is no reason at all to force a reply to a packet to
go out of the same interface as the packet which triggered
that reply arrived upon.

Re: Missing device binding relating to tcp_v4_send_reset?

[Ben Greear]

On 08/10/2010 01:48 AM, David Miller wrote:
> From: Ben Greear<greearb@candelatech.com>
> Date: Mon, 09 Aug 2010 10:46:26 -0700
>
>> This snippet is from some patches Patrick did for me some time
>> back.  I think the rest of his work has been merged upstream, but
>> this patch was not.  I'm honestly not sure if it's needed or not,
>> but we've been running with it for at least a year or so and it's
>> been working fine for us.
>
> There is no reason at all to force a reply to a packet to
> go out of the same interface as the packet which triggered
> that reply arrived upon.

Ok, in my case I *did* want this behaviour..it makes send-to-self,
BIND_TO_DEVICE and virtual routers and such work properly if I
recall correctly.

Would you consider a sysctl to enable this feature, with it disabled
by default?  Please note there are similar sysctls for ICMP already...

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com