ip: add loose reverse path filtering

Extend existing reverse path filter option to allow strict or loose
filtering. (See http://en.wikipedia.org/wiki/Reverse_path_filtering).

For compatibility with existing usage, the value 1 is chosen for strict mode
and 2 for loose mode.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index ff3f219ee4d7bc590ecea9a9144c094f78f07dbd..71041c21af9bf620da6583e921e9b39b427a0cba 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -699,16 +699,22 @@ accept_source_route - BOOLEAN
        default TRUE (router)
                FALSE (host)
 
-rp_filter - BOOLEAN
-       1 - do source validation by reversed path, as specified in RFC1812
-           Recommended option for single homed hosts and stub network
-           routers. Could cause troubles for complicated (not loop free)
-           networks running a slow unreliable protocol (sort of RIP),
-           or using static routes.
-
+rp_filter - INTEGER
        0 - No source validation.
-
-       conf/all/rp_filter must also be set to TRUE to do source validation
+       1 - Strict mode as defined in RFC3704 Strict Reverse Path
+           Each incoming packet is tested against the FIB and if the interface
+           is not the best reverse path the packet check will fail.
+           By default failed packets are discarded.
+       2 - Loose mode as defined in RFC3704 Loose Reverse Path
+           Each incoming packet's source address is also tested against the FIB
+           and if the source address is not reachable via any interface
+           the packet check will fail.
+
+        Current recommended practice in RFC3704 is to enable strict mode
+       to prevent IP spoofin from DDos attacks. If using asymmetric routing
+        or other complicated routing,t hen loose mode is recommended.
+
+       conf/all/rp_filter must also be set to non-zero to do source validation
        on the interface
 
        Default value is 0. Note that some distributions enable it

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 741e4fa3e4749e0285c39f65dc306e644fb4032b..cafcc49d0993b6a6b39590f6c2246fc806eb463d 100644 (file)
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -275,7 +275,7 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
        fib_res_put(&res);
        if (no_addr)
                goto last_resort;
-       if (rpf)
+       if (rpf == 1)
                goto e_inval;
        fl.oif = dev->ifindex;