netdev - Re: saddr based blackhole/unreachable route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 12 Oct 2016 00:13:12 +0200
From:   Bjørnar Ness <bjornar.ness@...il.com>
To:     netdev <netdev@...r.kernel.org>
Subject: Re: saddr based blackhole/unreachable route

2016-10-11 20:39 GMT+02:00 Bjørnar Ness <bjornar.ness@...il.com>:
> Hello, netdev
>
> In a typical setup (eth0=internet, eth1=lan) i populate routing table
> 100 with saddrs I want
> dropped, and: "ip ru a pref 100 lookup table 100"
>
> What I would expect to see is packets with a saddr in table 100 coming
> in eth0 will go out eth1,
> with replies beeing dropped, but I do not see the packets going out eth1 at all.
>
> Have tried searching and following the fib codepath, but have still
> not managed to understand what is really going on here.

Answering my own question, I guess its rp_filter kicking in here. and
it also explains
why I dont get icmp unreachable

Is there a better way to do source based rtbh?

-- 
Bj(/)rnar