netdev - Re: [PATCH] ip: add loose reverse path filtering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20090223134646.655abc1a@extreme>
Date:	Mon, 23 Feb 2009 13:46:46 -0800
From:	Stephen Hemminger <shemminger@...tta.com>
To:	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	David Miller <davem@...emloft.net>, hawk@...u.dk,
	netdev@...r.kernel.org
Subject: Re: [PATCH] ip: add loose reverse path filtering

On Sun, 22 Feb 2009 16:34:36 +0800
Herbert Xu <herbert@...dor.apana.org.au> wrote:

> On Sat, Feb 21, 2009 at 11:56:01PM -0800, David Miller wrote:
> >
> > > Rather than extending the rp_filter stuff any further, I'd prefer
> > > to see this replaced with netfilter plugin.
> > 
> > Normally I would agree, but in this case the cost is exactly
> > zero for the added flexibility.
> 
> Ah I thought there was another patch coming :) But obviously as
> this is all that's needed for it sure it looks good to me too.
> 
> Cheers,

Also, the purpose of reverse path filtering is to block Dos attacks.
So it is important to do any rejection with least overhead. If the
filter is iptables rules, it takes longer and requires another route
lookup.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html