RE: [PATCH] tcp: RST: binding oif to iif for tcp v4

 
See inline.
-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@gmail.com] 
Sent: Friday, February 03, 2012 1:32 PM
To: Shawn Lu
Cc: davem@davemloft.net; netdev@vger.kernel.org; xiaoclu@gmail.com
Subject: Re: [PATCH] tcp: RST: binding oif to iif for tcp v4

Le vendredi 03 février 2012 à 12:16 -0800, Shawn Lu a écrit :

Binding RST packet outgoing interface to incomming interface for tcp 
v4. This has few benefits:
1. tcp_v6_send_reset already did that.

I dont think so. ipv6 makes no special provision for RST.
[shawn LU] it's in  tcp_v6_send_response line 899 of tcp_ipv6.c
 fl6.flowi6_oif = inet6_iif(skb);

2. This helps tcp connect with SO_BINDTODEVICE set. When connection is 
lost, we still able to sending out RST using same interface.

I dont understand this.

[shawn Lu] ok.  Tcp socket is bind to device using SO_BINDTODEVICE  to
Limit traffic to specifc interface.  Sometime, it may not have a valid
Source address to get through ip_route_output_key. 

3. limit RST traffic in ingress interface reduce the impact of RST 
attack.

[shawn Lu] sometime, we want to limit unimportant traffic to certain interface
To reduce impact on other interface 

I dont understand this.

Me confused.

Why RST are special and should bypass/force routing decisions ?

This is going to break some setups.