Bug 1653824
| Summary: | Continue setting rp_filter=1 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Lubomir Rintel <lrintel> |
| Component: | systemd | Assignee: | Lukáš Nykrýn <lnykryn> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Frantisek Sumsal <fsumsal> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.0 | CC: | aloughla, fsumsal, lnykryn, lrintel, mleitner, systemd-maint-list, thaller, wchadwic |
| Target Milestone: | rc | Flags: | rule-engine:
mirror+
|
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | systemd-239-12.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-14 01:55:01 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Lubomir Rintel
2018-11-27 17:16:51 UTC
Upstream PR: https://github.com/systemd/systemd/pull/10971 Apologies for my impatient ping, but is there any chance to still get this for RHEL-8.0? fix merged to staging branch -> https://github.com/lnykryn/systemd-rhel/pull/255 -> post Notes from what we concluded in a meeting ========================================= It turns out this is not entirely problem-free. Notably, there would be some unpleasant surprises waiting for the users who are used to the old default. See bug #1669504. It seems we need to ship different defaults to server users than to the workstation users: The Workstation experience suffers from the rp_filter strict mode: in pressence of multiple routes to a same network, only one of the lowest metric works. This breaks the connections established over a wireless interface when the user plugs an ethernet plug and make connectivity checking of new connections impossible. The rp_filter makes sense on some server installations, routers particularly. Their users may already be relying on the default of strict rp_filter. It seems that we need to end up shipping different configurations to these groups: defaulting to one mode and overriding it where it doesn't make sense. Given most of our users are not Workstation users, let's do this: 1.) Flip the default in RHEL back to the strict mode (rp_filter=1) 2.) Override it with a drop-in file on Workstation. One possibility is to ship /usr/lib/sysctl.d/60-NetworkManager.conf that sets rp_filter=0 in NetworkManager-config-connectivity-rhel, becuase connectivity checking is where rp_filter gets in the way. Note that we're disabling it altogether (0) as opposed to setting it to the loose mode (2), because the two are equivalent in presence of a default route. Does this make sense? (In reply to Lubomir Rintel from comment #7) > 2.) Override it with a drop-in file on Workstation. One possibility is to > ship > /usr/lib/sysctl.d/60-NetworkManager.conf that sets rp_filter=0 in > NetworkManager-config-connectivity-rhel, becuase connectivity checking is > where rp_filter gets in the way. Note that we should also relax firewalld ip6 protection too then. Updating summary to reflect current understanding. Lets discuss this again for 8.1 then. Adding 8.1 bug to external trackers. fix merged to staging branch -> https://github.com/lnykryn/systemd-rhel/pull/292 -> post *** Bug 1669504 has been marked as a duplicate of this bug. *** |