3 ms·

This title is the opposite of reality. The kernel default for rp_filter is 0, which is disabled. For a long while, systemd had been closing this security hole,

by cesarb 7y ago

This title is the opposite of reality. The kernel default for rp_filter is 0, which is disabled. For a long while, systemd had been closing this security hole, by setting it by default to 1 (enabled in strict mode). The recent change in systemd was to change it by default to 2 (enabled in loose mode), which is still stricter than the kernel default of "disabled". See https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/networking/ip-sysctl.txt?h=v5.4#n1225 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... for the official documentation for this parameter.

MertsA 7y ago
Not to mention the CVE explicitly states that Devuan and the BSDs as well as a number of other non-systemd distros are affected. Looking closer the submitter here is the author of the post, the website it was submitted to is blocked from being submitted to /r/Linux for blogspam and the "Gangnam Style" links on the page appear to go to some shifty video site. The submitter and author is clearly just writing B.S. to drum up backlinks for some black hat SEO.
bonzini 7y ago
Also instructive is the commit message: > The Strict mode breaks some pretty common and reasonable use cases, such as keeping connections via one default route alive after another one appears (e.g. plugging an Ethernet cable when connected via Wi-Fi). > The strict filter also makes it impossible for NetworkManager to do connectivity check on a newly arriving default route (it starts with a higher metric and is bumped lower if there's connectivity). And it goes on pointing out what you also mentioned about kernel defaults: > Kernel's default is 0 (no filter), but a Loose filter is good enough. The few use cases where a Strict mode could make sense can easily override this.

3 ms·

This title is the opposite of reality. The kernel default for rp_filter is 0, which is disabled. For a long while, systemd had been closing this security hole,

by cesarb 7y ago

MertsA 7y ago
Not to mention the CVE explicitly states that Devuan and the BSDs as well as a number of other non-systemd distros are affected. Looking closer the submitter here is the author of the post, the website it was submitted to is blocked from being submitted to /r/Linux for blogspam and the "Gangnam Style" links on the page appear to go to some shifty video site. The submitter and author is clearly just writing B.S. to drum up backlinks for some black hat SEO.
bonzini 7y ago
Also instructive is the commit message: > The Strict mode breaks some pretty common and reasonable use cases, such as keeping connections via one default route alive after another one appears (e.g. plugging an Ethernet cable when connected via Wi-Fi). > The strict filter also makes it impossible for NetworkManager to do connectivity check on a newly arriving default route (it starts with a higher metric and is bumped lower if there's connectivity). And it goes on pointing out what you also mentioned about kernel defaults: > Kernel's default is 0 (no filter), but a Loose filter is good enough. The few use cases where a Strict mode could make sense can easily override this.