Enable reverse-path filter for IPv4
/proc/sys/net/ipv4/conf/*/rp_filter enforces filtering of packets to
make sure that only packets that match the route can be sent on an
interface. This is recommended for reducing IP spoofing as will as
allowing for proper UDP behavior when multiple configured NICs have the
same subnet.
This is needed for the upcoming change of phosphor-ipmi-net, were its
socket file uses the bind-to-device option to be able to bind each
instance to a single network interface. This allows each RMCP+ bridge
to accept only incoming packets on that interface. But in order to do
this with two NICs on the same subnet, reverse-path filtering must be
enabled in the kernel.
Change-Id: Iaae5783f8d30d8fc524ef3e19e776c75fe25bbfd
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
diff --git a/recipes-core/base-files/base-files_%.bbappend b/recipes-core/base-files/base-files_%.bbappend
index 83e455f..c77cfef 100644
--- a/recipes-core/base-files/base-files_%.bbappend
+++ b/recipes-core/base-files/base-files_%.bbappend
@@ -5,6 +5,7 @@
RDEPENDS_${PN}_append_df-obmc-ubi-fs = " preinit-mounts"
SRC_URI += " \
+ file://50-rp_filter.conf \
${@bb.utils.contains('DISTRO_FEATURES', 'ldap', 'file://nsswitch_ldap.conf', '', d)}"
do_install_append() {
@@ -14,4 +15,7 @@
if [ "${@bb.utils.filter('DISTRO_FEATURES', 'ldap', d)}" ]; then
install -D -m 600 ${WORKDIR}/nsswitch_ldap.conf ${D}/${sysconfdir}/nsswitch.conf
fi
+
+ install -d ${D}/${libdir}/sysctl.d
+ install -D -m 644 ${WORKDIR}/50-rp_filter.conf ${D}/${libdir}/sysctl.d/50-rp_filter.conf
}