On 12/3/20 8:16 PM, Andreas Roeseler wrote:
> Section 8 of RFC 8335 specifies potential security concerns of
> responding to PROBE requests, and states that nodes that support PROBE
> functionality MUST be able to enable/disable responses and it is
> disabled by default.
>
> Add sysctl to enable responses to PROBE messages.
>
> Signed-off-by: Andreas Roeseler <andreas.a.roese...@gmail.com>
> ---
> include/net/netns/ipv4.h | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
> index 8e4fcac4df72..1d9b74228f3e 100644
> --- a/include/net/netns/ipv4.h
> +++ b/include/net/netns/ipv4.h
> @@ -85,6 +85,7 @@ struct netns_ipv4 {
> #endif
>
> int sysctl_icmp_echo_ignore_all;
> + int sysctl_icmp_echo_enable_probe;
> int sysctl_icmp_echo_ignore_broadcasts;
> int sysctl_icmp_ignore_bogus_error_responses;
> int sysctl_icmp_ratelimit;
>
this can be folded into patch 4; no need for a standalone patch here.
