| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 11 Jun 2014 09:19:22 +0200 From: Per Jessen <per@...puter.org> To: Dmitry Popov <ixaphire@...tor.net> CC: Lukas Tribus <luky-37@...mail.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org> Subject: Re: missing icmp redirects Dmitry Popov wrote: > On Tue, 10 Jun 2014 20:10:23 +0200 > Per Jessen <per@...puter.org> wrote: > >> Lukas Tribus wrote: >>>> See complete description here: >>>> >>>> https://bugzilla.kernel.org/show_bug.cgi?id=72561 >>>> >>>> Summary - some ICMP redirects seem to be missing. >>>> >> Okay, I have devised a way to reproduce the problem: >> >> ... > > It's probably not a bug, but intended behavior. See ip_rt_send_redirect in > net/ipv4/route.c. The kernel has a built-in per-source-address limiter for icmp > redirects. Hi Dmitry Any possibility that this limiter may have been inactive/faulty in e.g. 2.6.34? We only hit this issue when we upgraded the firewall to a newer openSUSE (for ebtables) which came with kernel 3.11.6, but prior to that we had no issue with missing redirects. > You can disable it for example with > echo -1 > /proc/sys/net/ipv4/route/redirect_silence > Though I am not sure if it is ok in wild networks. Okay, that worked on the first attempt. Should I also be looking at the other redirect settings? /proc/sys/net/ipv4/route/redirect_load /proc/sys/net/ipv4/route/redirect_number thanks Per -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists