Subject: Re: [PATCH] Disable rp_filter for IPsec packets

From: Michael Smith <[email-masked]>
Date: Mon, 14 Mar 2011 17:29:43 -0400

David Miller wrote:
> First, I'm only willing to accept a patch like this to net-next-2.6
> for which all of the code you are changing is radically different.

OK.

> Secondly, fib_validate_source() already takes too many damn arguments.
> Find another, less costly, way to pass this information down there.

What would be a less costly way to pass it? Could I just hand it the 
whole skb?

> Frankly, I think RPF should be disabled completely by default.  When
> it doesn't do anything useful, it's making route lookups twice as
> expensive as they need to be.

Yeah, it's disabled by default. It's an easy way of preventing spoofing 
of internal source addresses from the Internet, so I like it.

Thanks,
Mike