lkml.org 
[lkml]   [2009]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: /proc/sys/net/ip*/conf/all/* does not actually affect interfaces
    Hello!

    On Mon, Mar 02, 2009 at 01:27:18PM +0100, martin f krafft wrote:
    > I was unpleasantly surprised last night that a rogue machine managed
    > to alter the IPv6 default route of one of my servers, despite my
    > sysctl configuration, which disables RA for "all" interfaces during
    > the boot sequence. It also changes the "default" values:
    ...
    > Yet, net.ipv6.conf.eth0.* values were unchanged, and routing
    > advertisements honoured.
    >
    > This also applies to files in ipv4/, e.g. accept_redirects
    ...

    As far as I researched for IPv4 some time ago, the "default" value gets
    copied to newly created interfaces only once.
    "all" on the other hand allways gets applied in addition to the current
    setting, but it depends on the exact setting, if its ORed, ANDed, or
    whatevered:
    log_martians OR
    accept_redirects AND
    forwarding ?
    mc_forwarding AND
    medium_id
    proxy_arp OR
    shared_media OR
    secure_redirects OR
    send_redirects OR
    bootp_relay AND
    accept_source_route AND
    rp_filter AND
    arp_filter OR
    arp_announce MAX
    arp_ignore MAX
    arp_accept
    app_solicit
    disable_policy
    disable_xfrm
    tag
    (see include/linux/inetdevice.h:83 for IN_DEV_{AND,OR,MAX}CONF)

    Putting a new value in "all" doesn't change the value you read from
    "$interface", but it only gets computed and used internally.

    BYtE
    Philipp
    --
    / / (_)__ __ ____ __ Philipp Hahn
    / /__/ / _ \/ // /\ \/ /
    /____/_/_//_/\_,_/ /_/\_\ pmhahn@titan.lahn.de


    \
     
     \ /
      Last update: 2009-03-03 08:03    [W:0.022 / U:29.944 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site