Messages in this thread | | | Date | Mon, 2 Mar 2009 13:27:18 +0100 | From | martin f krafft <> | Subject | /proc/sys/net/ip*/conf/all/* does not actually affect interfaces |
| |
Dear kernel gurus,
I was unpleasantly surprised last night that a rogue machine managed to alter the IPv6 default route of one of my servers, despite my sysctl configuration, which disables RA for "all" interfaces during the boot sequence. It also changes the "default" values:
net.ipv6.conf.default.autoconf = 0 net.ipv6.conf.default.accept_ra = 0 net.ipv6.conf.default.accept_ra_defrtr = 0 net.ipv6.conf.default.accept_ra_pinfo = 0 net.ipv6.conf.default.accept_source_route = 0 net.ipv6.conf.default.accept_redirects = 0 net.ipv6.conf.default.forwarding = 0 net.ipv6.conf.all.autoconf = 0 net.ipv6.conf.all.accept_ra = 0 net.ipv6.conf.all.accept_ra_defrtr = 0 net.ipv6.conf.all.accept_ra_pinfo = 0 net.ipv6.conf.all.accept_source_route = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv6.conf.all.forwarding = 0
Yet, net.ipv6.conf.eth0.* values were unchanged, and routing advertisements honoured.
This also applies to files in ipv4/, e.g. accept_redirects
A bit of investigation shows that something fishy is going on, or at least it's unexpected to me, because I recall the conf/all/* interface to do what it promised to do a while ago. Not anymore though.
seamus# pwd /proc/sys/net seamus# head ipv4/conf/{all,eth0}/accept_redirects ==> ipv4/conf/all/accept_redirects <== 1
==> ipv4/conf/eth0/accept_redirects <== 1 seamus# echo 0 >| ipv4/conf/all/accept_redirects seamus# head ipv4/conf/{all,eth0}/accept_redirects ==> ipv4/conf/all/accept_redirects <== 0
==> ipv4/conf/eth0/accept_redirects <== 1
***** shouldn't ipv4/conf/eth0/accept_redirects be 0 too??
same with ipv6:
seamus# head ipv6/conf/{all,eth0}/accept_ra ==> ipv6/conf/all/accept_ra <== 1
==> ipv6/conf/eth0/accept_ra <== 1 seamus# echo 0 >| ipv6/conf/all/accept_ra seamus# head ipv6/conf/{all,eth0}/accept_ra ==> ipv6/conf/all/accept_ra <== 0
==> ipv6/conf/eth0/accept_ra <== 1
What is going on? Is this my fault, did something change in the kernel, or is this a bug?
-- martin | http://madduck.net/ | http://two.sentenc.es/ "in the figure of the president, george w. bush, the incompetence, stupidity, and sheer inhumanity that characterize so much of america's money-mad corporate elite find their quintessentially repulsive expression." -- journalist, aftermath of katrina spamtraps: madduck.bogus@madduck.net [unhandled content-type:application/pgp-signature] | |