Bug#557448: linux-image-2.6.31-1-amd64: net.ipv4.conf.all.secure_redirects not working
Package: linux-2.6
Version: 2.6.31-2
Severity: normal
Hi
I have a local lan network
192.168.11.0/24 dgw - 192.168.11.1
I also have a wireless network
192.168.10.0/24 dgw - 192.168.10.1
the router at 192.168.10.1 is a linux server with the address 192.168.11.10 as well.
I have placed a ip route add/replace 192.168.10.0/24 via 192.168.11.10 on 192.168.11.1 this send the appropiate icmp redirects for 192.168.10.0/24 via 192.168.11.10
what seems to be failing is this scenario.
laptop connected to 192.168.11.0/24 (ip via dhcp) with
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 1
All the other interface redirects set to 1
with another linux machine (alex-mini) on the wireless (192.168.10.0/24 - ip via dhcp), I try and ssh to laptop - which fails.
When I look at the tcpdump on laptop I see the packets coming in but laptop is trying to send the packets via 192.168.11.1, it doesn't seem to acknowledge the icmp redirects even though I have secure_redirects set to 1 and 192.168.11.1 is the default gateway..
when I set net.ipv4.conf.all.accept_redirects to 1 everything works fine, the icmp redirect is accepted....
this seems to be contry to the documenation in sysctl.conf , which says these flags are OR
Alex
-- Package-specific info:
** Version:
Linux version 2.6.31-1-amd64 (Debian 2.6.31-2) (ben@decadent.org.uk) (gcc version 4.3.4 (Debian 4.3.4-6) ) #1 SMP Mon Nov 16 04:44:38 UTC 2009
** Network interface configuration:
# The loopback network interface
auto lo
iface lo inet loopback
up /sbin/ip addr add 10.160.16.25/32 dev lo || true
*** Protocol statistics:
Ip:
39701407 total packets received
117991 forwarded
0 incoming packets discarded
39576807 incoming packets delivered
39403782 requests sent out
6 outgoing packets dropped
32 dropped because of missing route
85300 reassemblies required
3740 packets reassembled ok
22849397 fragments received ok
137447614 fragments created
Icmp:
169354 ICMP messages received
92 input ICMP message failed.
ICMP input histogram:
destination unreachable: 63359
timeout in transit: 652
source quenches: 103
echo requests: 6831
echo replies: 98409
132756 ICMP messages sent
0 ICMP messages failed
ICMP output histogram:
destination unreachable: 7509
echo request: 118416
echo replies: 6831
IcmpMsg:
InType0: 98409
InType3: 63359
InType4: 103
InType8: 6831
InType11: 652
OutType0: 6831
OutType3: 7509
OutType8: 118416
Tcp:
191776 active connections openings
195099 passive connection openings
24493 failed connection attempts
50698 connection resets received
53 connections established
80579667 segments received
19858029 segments send out
495800 segments retransmited
0 bad segments received.
115658 resets sent
Udp:
26941970 packets received
2996 packets to unknown port received.
795 packet receive errors
26043168 packets sent
RcvbufErrors: 795
UdpLite:
TcpExt:
47059 invalid SYN cookies received
3736 resets received for embryonic SYN_RECV sockets
7 packets pruned from receive queue because of socket buffer overrun
101 ICMP packets dropped because they were out-of-window
145352 TCP sockets finished time wait in fast timer
249 time wait sockets recycled by time stamp
1853 packets rejects in established connections because of timestamp
216192 delayed acks sent
144 delayed acks further delayed because of locked socket
Quick ack mode was activated 246704 times
434069 packets directly queued to recvmsg prequeue.
1343873 bytes directly in process context from backlog
61366549 bytes directly received in process context from prequeue
4767102 packet headers predicted
268779 packets header predicted and directly queued to user
5511019 acknowledgments not containing data payload received
68244459 predicted acknowledgments
224 times recovered from packet loss due to fast retransmit
73222 times recovered from packet loss by selective acknowledgements
Detected reordering 55 times using FACK
Detected reordering 153 times using SACK
Detected reordering 107 times using time stamp
168 congestion windows fully recovered without slow start
312 congestion windows partially recovered using Hoe heuristic
2451 congestion windows recovered without slow start by DSACK
29551 congestion windows recovered without slow start after partial ack
243483 TCP data loss events
TCPLostRetransmit: 4136
176 timeouts after reno fast retransmit
30813 timeouts after SACK recovery
10693 timeouts in loss state
115414 fast retransmits
3780 forward retransmits
70669 retransmits in slow start
125515 other TCP timeouts
68 classic Reno fast retransmits failed
9686 SACK retransmits failed
704 packets collapsed in receive queue due to low socket buffer
34162 DSACKs sent for old packets
48 DSACKs sent for out of order packets
27300 DSACKs received
514 DSACKs for out of order packets received
16660 connections reset due to unexpected data
34736 connections reset due to early user close
4397 connections aborted due to timeout
TCPSACKDiscard: 32
TCPDSACKIgnoredOld: 15692
TCPDSACKIgnoredNoUndo: 9571
TCPSpuriousRTOs: 2392
TCPSackShifted: 948138
TCPSackMerged: 413258
TCPSackShiftFallback: 243506
IpExt:
InNoRoutes: 11
InMcastPkts: 494
OutMcastPkts: 498
InBcastPkts: 15507
OutBcastPkts: 7536
InOctets: 2085206650
OutOctets: 1510134990
InMcastOctets: 87731
OutMcastOctets: 87891
InBcastOctets: 1541494
OutBcastOctets: 831894
** USB devices:
Bus 004 Device 002: ID 046d:c517 Logitech, Inc. LX710 Cordless Desktop Laser
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 005 Device 002: ID 051d:0002 American Power Conversion Uninterruptible Power Supply
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 003: ID 046d:0990 Logitech, Inc. QuickCam Pro 9000
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 05e3:0608 Genesys Logic, Inc. USB-2.0 4-Port HUB
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Kernel: Linux 2.6.31-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_AU.UTF8, LC_CTYPE=en_AU.UTF8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages linux-image-2.6.31-1-amd64 depends on:
ii debconf [debconf-2.0] 1.5.28 Debian configuration management sy
ii initramfs-tools [linux-initra 0.93.4 tools for generating an initramfs
ii module-init-tools 3.11-1 tools for managing Linux kernel mo
Versions of packages linux-image-2.6.31-1-amd64 recommends:
pn firmware-linux-free <none> (no description available)
Versions of packages linux-image-2.6.31-1-amd64 suggests:
pn grub | lilo <none> (no description available)
pn linux-doc-2.6.31 <none> (no description available)
Versions of packages linux-image-2.6.31-1-amd64 is related to:
pn firmware-bnx2 <none> (no description available)
pn firmware-bnx2x <none> (no description available)
pn firmware-ipw2x00 <none> (no description available)
pn firmware-ivtv <none> (no description available)
pn firmware-iwlwifi <none> (no description available)
pn firmware-linux <none> (no description available)
pn firmware-linux-nonfree <none> (no description available)
pn firmware-qlogic <none> (no description available)
pn firmware-ralink <none> (no description available)
--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
02-02-2010, 08:50 PM
maximilian attems
Bug#557448: linux-image-2.6.31-1-amd64: net.ipv4.conf.all.secure_redirects not working
tags 557448 moreinfo
stop
On Sun, 22 Nov 2009, Alex Samad wrote:
> Hi
>
> I have a local lan network
> 192.168.11.0/24 dgw - 192.168.11.1
>
> I also have a wireless network
> 192.168.10.0/24 dgw - 192.168.10.1
>
> the router at 192.168.10.1 is a linux server with the address 192.168.11.10 as well.
>
> I have placed a ip route add/replace 192.168.10.0/24 via 192.168.11.10 on 192.168.11.1 this send the appropiate icmp redirects for 192.168.10.0/24 via 192.168.11.10
>
> what seems to be failing is this scenario.
>
> laptop connected to 192.168.11.0/24 (ip via dhcp) with
> net.ipv4.conf.all.accept_redirects = 0
> net.ipv4.conf.all.secure_redirects = 1
>
> All the other interface redirects set to 1
>
> with another linux machine (alex-mini) on the wireless (192.168.10.0/24 - ip via dhcp), I try and ssh to laptop - which fails.
>
> When I look at the tcpdump on laptop I see the packets coming in but laptop is trying to send the packets via 192.168.11.1, it doesn't seem to acknowledge the icmp redirects even though I have secure_redirects set to 1 and 192.168.11.1 is the default gateway..
>
> when I set net.ipv4.conf.all.accept_redirects to 1 everything works fine, the icmp redirect is accepted....
>
> this seems to be contry to the documenation in sysctl.conf , which says these flags are OR
>
> Alex
17:41 <bwh> Documentation/networking/ip-sysctl.txt says "secure_redirects -
BOOLEAN Accept ICMP redirect messages only for gateways, listed in
default gateway list."
17:42 <bwh> So my guess is that in #557448 the submitter has not listed both
gateways in DHCP
can you verify please aboves?
--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
02-02-2010, 09:49 PM
"Alex Samad"
Bug#557448: linux-image-2.6.31-1-amd64: net.ipv4.conf.all.secure_redirects not working
I have a chat on the linux-kernel ml and basically you have to set both of
the redirects.
So you can close the bug.
Thanks
-----Original Message-----
From: maximilian attems [mailto:max@stro.at]
Sent: Wednesday, 3 February 2010 8:50 AM
To: Alex Samad; 557448@bugs.debian.org
Subject: Re: Bug#557448: linux-image-2.6.31-1-amd64:
net.ipv4.conf.all.secure_redirects not working
tags 557448 moreinfo
stop
On Sun, 22 Nov 2009, Alex Samad wrote:
> Hi
>
> I have a local lan network
> 192.168.11.0/24 dgw - 192.168.11.1
>
> I also have a wireless network
> 192.168.10.0/24 dgw - 192.168.10.1
>
> the router at 192.168.10.1 is a linux server with the address
192.168.11.10 as well.
>
> I have placed a ip route add/replace 192.168.10.0/24 via 192.168.11.10 on
192.168.11.1 this send the appropiate icmp redirects for 192.168.10.0/24 via
192.168.11.10
>
> what seems to be failing is this scenario.
>
> laptop connected to 192.168.11.0/24 (ip via dhcp) with
> net.ipv4.conf.all.accept_redirects = 0
> net.ipv4.conf.all.secure_redirects = 1
>
> All the other interface redirects set to 1
>
> with another linux machine (alex-mini) on the wireless (192.168.10.0/24 -
ip via dhcp), I try and ssh to laptop - which fails.
>
> When I look at the tcpdump on laptop I see the packets coming in but
laptop is trying to send the packets via 192.168.11.1, it doesn't seem to
acknowledge the icmp redirects even though I have secure_redirects set to 1
and 192.168.11.1 is the default gateway..
>
> when I set net.ipv4.conf.all.accept_redirects to 1 everything works fine,
the icmp redirect is accepted....
>
> this seems to be contry to the documenation in sysctl.conf , which says
these flags are OR
>
> Alex
17:41 <bwh> Documentation/networking/ip-sysctl.txt says "secure_redirects -
BOOLEAN Accept ICMP redirect messages only for gateways, listed
in
default gateway list."
17:42 <bwh> So my guess is that in #557448 the submitter has not listed both
gateways in DHCP
can you verify please aboves?
--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org