Public bug reported:
The kernel uses the maximum of net.ipv4.conf.all.rp_filter and
net.ipv4.conf.$link.rp_filter, which means that if
net.ipv4.conf.all.rp_filter=2, then in effect a less strict setting
cannot be used on a per-link basis. This can lead to confusion for
admins trying to use e.g. IPv4ReversePathFilter= in .network
configurations.
To enable sensible defaults, systemd's /usr/lib/sysctl.d/50-default.conf
has the following:
# Source route verification
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.*.rp_filter = 2
-net.ipv4.conf.all.rp_filter
In other words, new and existing links default to rp_filter=2, but it
remains possible to override on a per-link basis.
However, Ubuntu (a) does not ship 50-default.conf from systemd, and (b)
ships 55-network-security.conf in procps with:
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks.
net.ipv4.conf.default.rp_filter=2
net.ipv4.conf.all.rp_filter=2
Note that Debian does *not* ship this configuration (sysctl.d configs in
procps are entirely Ubuntu delta), and the 50-default.conf from linux-
sysctl-defaults is based on systemd's configuration (including the
relevant rp_filter configuration).
We should drop this delta to align more with Debian, and apply the more
sensible default.
** Affects: procps (Ubuntu)
Importance: Medium
Assignee: Nick Rosbrook (enr0n)
Status: In Progress
** Changed in: procps (Ubuntu)
Status: New => In Progress
** Changed in: procps (Ubuntu)
Assignee: (unassigned) => Nick Rosbrook (enr0n)
** Changed in: procps (Ubuntu)
Importance: Undecided => Medium
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172969
Title:
sysctl default net.ipv4.conf.all.rp_filter=2 is too strict
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/procps/+bug/2172969/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
