Messages in this thread | | | Date | Mon, 14 Sep 2009 17:21:18 +0200 | From | Eric Dumazet <> | Subject | Re: ipv4 regression in 2.6.31 ? |
| |
Stephan von Krawczynski a écrit : > On Mon, 14 Sep 2009 15:57:03 +0200 > Eric Dumazet <eric.dumazet@gmail.com> wrote: > >> Stephan von Krawczynski a écrit : >>> Hello all, >>> >>> today we experienced some sort of regression in 2.6.31 ipv4 implementation, or >>> at least some incompatibility with former 2.6.30.X kernels. >>> >>> We have the following situation: >>> >>> ---------- vlan1@eth0 192.168.2.1/24 >>> / >>> host A 192.168.1.1/24 eth0 -------<router> host B >>> \ >>> ---------- eth1 192.168.3.1/24 >>> >>> >>> Now, if you route 192.168.1.0/24 via interface vlan1@eth0 on host B and let >>> host A ping 192.168.2.1 everything works. But if you route 192.168.1.0/24 via >>> interface eth1 on host B and let host A ping 192.168.2.1 you get no reply. >>> With tcpdump we see the icmp packets arrive at vlan1@eth0, but no icmp echo >>> reply being generated neither on vlan1 nor eth1. >>> Kernels 2.6.30.X and below do not show this behaviour. >>> Is this intended? Do we need to reconfigure something to restore the old >>> behaviour? >>> >> Asymetric routing ? >> >> Check your rp_filter settings >> >> grep . `find /proc/sys/net -name rp_filter` >> >> rp_filter - INTEGER >> 0 - No source validation. >> 1 - Strict mode as defined in RFC3704 Strict Reverse Path >> Each incoming packet is tested against the FIB and if the interface >> is not the best reverse path the packet check will fail. >> By default failed packets are discarded. >> 2 - Loose mode as defined in RFC3704 Loose Reverse Path >> Each incoming packet's source address is also tested against the FIB >> and if the source address is not reachable via any interface >> the packet check will fail. >> >> Current recommended practice in RFC3704 is to enable strict mode >> to prevent IP spoofing from DDos attacks. If using asymmetric routing >> or other complicated routing, then loose mode is recommended. >> >> conf/all/rp_filter must also be set to non-zero to do source validation >> on the interface >> >> Default value is 0. Note that some distributions enable it >> in startup scripts. > > Problem is this: > Kernel 2.6.30.X and below work flawlessly in this setup, only kernel 2.6.31 > acts different. Is this an intended change in policy? >
Here, it only depends on rp_filter settings, kernel 2.6.30 or 2.6.31
Please give your settings for further investigations, for all hosts involved.
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |