summaryrefslogtreecommitdiff
path: root/templates/firewall/source-validation/node.def
blob: 7853bec3d3af352f9a2fb1623323327ff7a0f687 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
# rp_filter
# default value - 0
# conf/all/rp_filter and conf/[interface]/rp_filter both must be set to
# a value greater than 0 to do source validation on the interface


type: txt

help: Policy for source validation by reversed path, as specified in RFC3704

comp_help:Possible completions:
  strict\tEnable Strict Reverse Path Forwarding as defined in RFC3704
  loose\t\tEnable Loose Reverse Path Forwarding as defined in RFC3704
  disable\tNo source validation

default: "disable"

syntax:expression: $VAR(@) in "strict", "loose", "disable"; "source-validation must be set to 'loose', 'strict' or 'disable'"

update:
        array=(`ls /proc/sys/net/ipv4/conf/`)
        array_len=${#array[*]}
        i=0
        if [ x$VAR(@) == xstrict ]; then
            while [ $i -lt $array_len ]; do
               sudo sh -c "echo 1 > \
                 /proc/sys/net/ipv4/conf/${array[$i]%:*}/rp_filter"
               let i++
            done
        elif [ x$VAR(@) == xloose ]; then
            while [ $i -lt $array_len ]; do
               sudo sh -c "echo 2 > \
                 /proc/sys/net/ipv4/conf/${array[$i]%:*}/rp_filter"
               let i++
            done
        else
           sudo sh -c "echo 0 > \
               /proc/sys/net/ipv4/conf/all/rp_filter"
	fi

delete:
	sudo sh -c "echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter"