maple/prplos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

base-files: sysctl.d: fix failing cdrouter_firewall_508 test

Browse Source 
cdrouter_firewall_508: Verify outbound packets are not forwarded if the
                 source address is not a prefix of the interior network

This test ensures that the random martian address assigned to the LAN
client in step 2 is outside of lanIp/lanMask, does not match any static
routes configured with staticRouteLanNetwork and is not within any of
the following reserved IP ranges: 0.0.0.0/8,
127.0.0.0/8, 169.254.0.0/16, 192.88.99.0/24, 224.0.0.0/4,
240.0.0.0/4, 255.255.255.255/32.

Make the test pass by setting `rp_filter` to strict mode. Strict mode as
defined in RFC3704 Strict Reverse Path Each incoming packet is tested
against the FIB and if the interface is not the best reverse path the
packet check will fail.  By default failed packets are discarded.

Current recommended practice in RFC3704 is to enable strict mode to
prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.

References: PCF-548
References: https://tools.ietf.org/html/rfc3704
References: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit b9ad7cbf75a4a99b22ef0906d8a76d7b71a8df97)
(cherry picked from commit 4a593e72e3b4751074311f1d1f3607b13d5d9128)
This commit is contained in:
Petr Štetiar 2022-02-04 12:13:56 +01:00 committed by Petr Štetiar
parent 2eacc18b31
commit e899dc0a33
No known key found for this signature in database
GPG Key ID: 58EE120F30CC02D3
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/base-files/files/etc/sysctl.d/10-default.conf
View File

@ -13,6 +13,8 @@ net.core.bpf_jit_kallsyms=1
net.ipv4.conf.default.arp_ignore=1
net.ipv4.conf.all.arp_ignore=1
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.ip_forward=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1