From: Eric Leblond <eric@xxxxxxxxx> Date: Mon, 6 Jun 2011 19:53:25 +0200 > This patch provides a basic implementation of reverse path filtering > for IPv6. Functionnality can be activatedor desactivated through an > rp_filter entry similar to the IPv4 one. > > The functionnality is disabled by default for backward compatibility > but should be enable on all IPv6 routers/firewalls for security reason. > > This implementation is heavily based on the patch Denis Semmau proposed > in 2006. > > Signed-off-by: Eric Leblond <eric@xxxxxxxxx> Do you know that this will make every forwarding route lookup up to 3 times slower? And you're not even caching the result like we do in ipv4, so every single forwarded PACKET, eats this overhead. Also, when enabled, this often breaks IPSEC. Frankly, when I remove the routing cache from ipv4, I want to get rid of RP filtering entirely. I think the BSD guys did the right thing, and put this in the firewalling code. Then people can add a forwarding rule that does this reverse path lookup, and the rest of the world doesn't need to eat this overhead. Finally, I want you to tell everyone why you want this change. People might find a less painful way to fix that issue. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html