netdev - [PATCH v2 0/2] Disable rp_filter for IPsec packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1302187911-20688-1-git-send-email-msmith@cbnco.com>
Date:	Thu,  7 Apr 2011 10:51:49 -0400
From:	Michael Smith <msmith@...co.com>
To:	netdev@...r.kernel.org
Subject: [PATCH v2 0/2] Disable rp_filter for IPsec packets

The reverse path filter interferes with IPsec subnet-to-subnet tunnels,
especially when the link to the IPsec peer is on an interface other than
the one hosting the default route.

IPsec provides a much stronger anti-spoofing policy than rp_filter, so
this patch disables the rp_filter for packets with a security path.

Patch is against net-next.

(old discussion here: http://patchwork.ozlabs.org/patch/86826/)

Michael Smith (2):
  fib_validate_source(): pass sk_buff instead of mark
  Disable rp_filter for IPsec packets

 include/net/ip_fib.h    |    6 +++---
 include/net/xfrm.h      |    9 +++++++++
 net/ipv4/fib_frontend.c |   16 +++++++++-------
 net/ipv4/route.c        |   16 ++++++++--------
 4 files changed, 29 insertions(+), 18 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html