/proc/sys/net/ip*/conf/all/* does not actually affect interfaces

[martin f krafft]

Dear kernel gurus,

I was unpleasantly surprised last night that a rogue machine managed
to alter the IPv6 default route of one of my servers, despite my
sysctl configuration, which disables RA for "all" interfaces during
the boot sequence. It also changes the "default" values:

  net.ipv6.conf.default.autoconf = 0
  net.ipv6.conf.default.accept_ra = 0
  net.ipv6.conf.default.accept_ra_defrtr = 0
  net.ipv6.conf.default.accept_ra_pinfo = 0
  net.ipv6.conf.default.accept_source_route = 0
  net.ipv6.conf.default.accept_redirects = 0
  net.ipv6.conf.default.forwarding = 0
  net.ipv6.conf.all.autoconf = 0
  net.ipv6.conf.all.accept_ra = 0
  net.ipv6.conf.all.accept_ra_defrtr = 0
  net.ipv6.conf.all.accept_ra_pinfo = 0
  net.ipv6.conf.all.accept_source_route = 0
  net.ipv6.conf.all.accept_redirects = 0
  net.ipv6.conf.all.forwarding = 0

Yet, net.ipv6.conf.eth0.* values were unchanged, and routing
advertisements honoured.

This also applies to files in ipv4/, e.g. accept_redirects

A bit of investigation shows that something fishy is going on, or
at least it's unexpected to me, because I recall the conf/all/*
interface to do what it promised to do a while ago. Not anymore
though.

seamus# pwd
/proc/sys/net
seamus# head ipv4/conf/{all,eth0}/accept_redirects  
==> ipv4/conf/all/accept_redirects <==
1

==> ipv4/conf/eth0/accept_redirects <==
1
seamus# echo 0 >| ipv4/conf/all/accept_redirects  
seamus# head ipv4/conf/{all,eth0}/accept_redirects  
==> ipv4/conf/all/accept_redirects <==
0

==> ipv4/conf/eth0/accept_redirects <==
1



***** shouldn't ipv4/conf/eth0/accept_redirects be 0 too??


same with ipv6:

seamus# head ipv6/conf/{all,eth0}/accept_ra
==> ipv6/conf/all/accept_ra <==
1

==> ipv6/conf/eth0/accept_ra <==
1
seamus# echo 0 >| ipv6/conf/all/accept_ra
seamus# head ipv6/conf/{all,eth0}/accept_ra
==> ipv6/conf/all/accept_ra <==
0

==> ipv6/conf/eth0/accept_ra <==
1



What is going on? Is this my fault, did something change in the
kernel, or is this a bug?

-- 
martin | http://madduck.net/ | http://two.sentenc.es/
 
"in the figure of the president, george w. bush, the incompetence,
 stupidity, and sheer inhumanity that characterize so much of
 america's money-mad corporate elite find their quintessentially
 repulsive expression."
                                 -- journalist, aftermath of katrina
 
spamtraps: madduck.bogus@xxxxxxxxxxx

Attachment: digital_signature_gpg.asc
Description: Digital signature (see http://martin-krafft.net/gpg/)