Advanced rp_ filter

on YouTube ↗33m

" summary

Covers the IETF RPF variants and how Linux implements them (sysctl + iptables/ip6tables + nftables), showing five divergent implementations and concrete failures: strict RPF drops traffic with asymmetric routes, ECMP and duplicate-route semantics differ across implementations, policy routing breaks when DSCP, packet mark or socket UID aren’t mirrored, and equal‑cost multipath yields inconsistent acceptance. Demonstrates that feasible RPF and the extensions in RFC 8704 require BGP cooperation and admin workarounds; enabling rp_filter is not just flipping a sysctl.

AI-written summary · about

" chapters (6)

1. 0:00RP filter introduction
2. 3:54IETF RPF algorithms
3. 12:32Linux RP filter
4. 18:25Policy routing with RP filter
5. 26:22RP filter summary
6. 28:35Q&A on RP filter

" related talks

• 21mStealth BGP Hijacks with uRPF FilteringHaya Schulmann, Shujie Zhao · 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25)
• 33mbpfilter: a BPF-based packet filtering frameworkQuentin Deslandes · Linux Plumbers Conference 2023
• 32mDemystifying eBPF - eBPF Firewall from scratchFilip Nikolic · Kubernetes Community Days Zürich 2023
• 12mxBGP: Faster Innovation in Routing ProtocolsThomas Wirtgen, Tom Rousseaux, Quentin De Coninck, Nicolas Rybowski, Randy Bush, Laurent Vanbever, Axel Legay, Olivier Bonaventure · NSDI 2023
• 28mSafe sharing of the network with eBPFPrankur Gupta, Balasubramanian Madhavan · Linux Plumbers Conference 2023
• 32meBPF: BPF kernel infrastructureT K Sourabh · Rootconf Pune 2019
• 27mSimplifying and Making the Network Programmable with Kubernetes and SRv6Daniel Bernier, Louis De Los Santos, Daniel Bernier, Bell Canada, Louis De Los Santos, Isovalent · Cloud Native eBPF Day North America 2022
• 21mR2P2: Making RPCs first-class datacenter citizensAdrien Ghosn, Marios Kogias, Edouard Bugnion, George Prekas, Jonas Fietz · USENIX ATC '19