diff options
| author |   Paolo Abeni <pabeni@redhat.com> | 2015-10-09 14:34:31 +0200 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2015-10-12 19:38:02 -0700 |
| commit | e2ca690b657f4ca5c204fcc6470d462b776d73b3 (patch) | |
| tree | bad7ed1b3899da4affa41704c52c27e0a8a616c0 /include/net | |
| parent | bridge: try switchdev op first in __vlan_vid_add/del (diff) | |
| download | linux-dev-e2ca690b657f4ca5c204fcc6470d462b776d73b3.tar.xz linux-dev-e2ca690b657f4ca5c204fcc6470d462b776d73b3.zip | |
ipv4/icmp: redirect messages can use the ingress daddr as source
This patch allows configuring how the source address of ICMP
redirect messages is selected; by default the old behaviour is
retained, while setting icmp_redirects_use_orig_daddr force the
usage of the destination address of the packet that caused the
redirect.
The new behaviour fits closely the RFC 5798 section 8.1.1, and fix the
following scenario:
Two machines are set up with VRRP to act as routers out of a subnet,
they have IPs x.x.x.1/24 and x.x.x.2/24, with VRRP holding on to
x.x.x.254/24.
If a host in said subnet needs to get an ICMP redirect from the VRRP
router, i.e. to reach a destination behind a different gateway, the
source IP in the ICMP redirect is chosen as the primary IP on the
interface that the packet arrived at, i.e. x.x.x.1 or x.x.x.2.
The host will then ignore said redirect, due to RFC 1122 section 3.2.2.2,
and will continue to use the wrong next-op.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net')
| -rw-r--r-- | include/net/netns/ipv4.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h index c68926b4899c..46d336abca92 100644 --- a/include/net/netns/ipv4.h +++ b/include/net/netns/ipv4.h @@ -74,6 +74,7 @@ struct netns_ipv4 { int sysctl_icmp_ratelimit; int sysctl_icmp_ratemask; int sysctl_icmp_errors_use_inbound_ifaddr; + int sysctl_icmp_redirects_use_orig_daddr; struct local_ports ip_local_ports; |