netdev - [PATCH 1/2] Doc: Fix rp_filter description in net/ipv4/Kconfig.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1235142193.2351.41.camel@localhost.localdomain>
Date:	Fri, 20 Feb 2009 16:03:13 +0100
From:	Jesper Dangaard Brouer <jdb@...x.dk>
To:	"David S. Miller" <davem@...emloft.net>
Cc:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Kernel Janitors <kernel-janitors@...r.kernel.org>
Subject: [PATCH 1/2] Doc: Fix rp_filter description in net/ipv4/Kconfig.

Author: Jesper Dangaard Brouer <hawk@...x.dk>
Date:   Fri Feb 20 15:20:57 2009 +0100

    Doc: Fix rp_filter description in net/ipv4/Kconfig.
    
    The reverse path filter (rp_filter) will NOT get enabled
    when enabling forwarding.  Read the code and tested in
    in practice.
    
    Most distributions does enable it in startup scripts.
    
    Signed-off-by: Jesper Dangaard Brouer <hawk@...x.dk>

diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 691268f..10c944d 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -35,7 +35,7 @@ config IP_ADVANCED_ROUTER
 
 	  at boot time after the /proc file system has been mounted.
 
-	  If you turn on IP forwarding, you will also get the rp_filter, which
+	  If you turn on IP forwarding, you should consider the rp_filter, which
 	  automatically rejects incoming packets if the routing table entry
 	  for their source address doesn't match the network interface they're
 	  arriving on. This has security advantages because it prevents the
@@ -46,9 +46,11 @@ config IP_ADVANCED_ROUTER
 	  rp_filter on use:
 
 	  echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter
-	  or
+	   and
 	  echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
 
+	  Note that some distributions enable it in startup scripts.
+
 	  If unsure, say N here.
 
 choice 

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html