netdev - Re: [PATCH iproute2 v2 2/2] ip rule: add route suppression options

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20130804115622.0f3d26c7@nehalam.linuxnetplumber.net>
Date:	Sun, 4 Aug 2013 11:56:22 -0700
From:	Stephen Hemminger <stephen@...workplumber.org>
To:	Stefan Tomanek <stefan.tomanek@...tarbyte.de>
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH iproute2 v2 2/2] ip rule: add route suppression options

On Sat, 3 Aug 2013 14:23:16 +0200
Stefan Tomanek <stefan.tomanek@...tarbyte.de> wrote:

> When configuring a system with multiple network uplinks and default routes, it
> is often convenient to reference a routing table multiple times - but reject
> its routing decision if certain constraints are not met by it.
> 
> Consider this setup:
> 
> $ ip route add table secuplink default via 10.42.23.1
> 
> $ ip rule add pref 100            table main suppress_prefixlength 0
> $ ip rule add pref 150 fwmark 0xA table secuplink
> 
> With this setup, packets marked 0xA will be processed by the additional routing
> table "secuplink", but only if no suitable route in the main routing table can
> be found. By suppressing entries with a prefixlength of 0 (or less), the
> default route (/0) of the table "main" is hidden to packets processed by rule
> 100; packets traveling to destinations via more specific routes are processed
> as usual.
> 
> It is also possible to suppress a routing entry if a device belonging to
> a specific interface group is to be used:
> 
> $ ip rule add pref 150 table main suppress_group 1
> 
> Signed-off-by: Stefan Tomanek <stefan.tomanek@...tarbyte.de>

Applied to net-next-3.11 branch
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html