From e899dc0a33349aff771bbebf1197ac7029e84954 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0tetiar?= Date: Fri, 4 Feb 2022 12:13:56 +0100 Subject: [PATCH] base-files: sysctl.d: fix failing cdrouter_firewall_508 test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cdrouter_firewall_508: Verify outbound packets are not forwarded if the source address is not a prefix of the interior network This test ensures that the random martian address assigned to the LAN client in step 2 is outside of lanIp/lanMask, does not match any static routes configured with staticRouteLanNetwork and is not within any of the following reserved IP ranges: 0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 192.88.99.0/24, 224.0.0.0/4, 240.0.0.0/4, 255.255.255.255/32. Make the test pass by setting `rp_filter` to strict mode. Strict mode as defined in RFC3704 Strict Reverse Path Each incoming packet is tested against the FIB and if the interface is not the best reverse path the packet check will fail. By default failed packets are discarded. Current recommended practice in RFC3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or other complicated routing, then loose mode is recommended. References: PCF-548 References: https://tools.ietf.org/html/rfc3704 References: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt Signed-off-by: Petr Štetiar (cherry picked from commit b9ad7cbf75a4a99b22ef0906d8a76d7b71a8df97) (cherry picked from commit 4a593e72e3b4751074311f1d1f3607b13d5d9128) --- package/base-files/files/etc/sysctl.d/10-default.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/package/base-files/files/etc/sysctl.d/10-default.conf b/package/base-files/files/etc/sysctl.d/10-default.conf index ee7df2bfa6..cc0e513f55 100644 --- a/package/base-files/files/etc/sysctl.d/10-default.conf +++ b/package/base-files/files/etc/sysctl.d/10-default.conf @@ -13,6 +13,8 @@ net.core.bpf_jit_kallsyms=1 net.ipv4.conf.default.arp_ignore=1 net.ipv4.conf.all.arp_ignore=1 +net.ipv4.conf.default.rp_filter=1 +net.ipv4.conf.all.rp_filter=1 net.ipv4.ip_forward=1 net.ipv4.icmp_echo_ignore_broadcasts=1 net.ipv4.icmp_ignore_bogus_error_responses=1