From: Sapan Bhatia <gwsapan@gmail.com>
Date: Tue, 2 Apr 2013 13:48:21 +0000 (-0400)
Subject: Option to drop kernel RSTs for TCP implementers
X-Git-Tag: vsys-scripts-0.95-46~2
X-Git-Url: http://git.onelab.eu/?p=vsys-scripts.git;a=commitdiff_plain;h=6577143439e17d82c15c64c0428ab5bfb4c43e78

Option to drop kernel RSTs for TCP implementers
---

diff --git a/root-context/exec/vif_up b/root-context/exec/vif_up
index 2ee81a4..361dca0 100755
--- a/root-context/exec/vif_up
+++ b/root-context/exec/vif_up
@@ -12,6 +12,7 @@
 # Options:
 #   - pointopoint=IP: other endpoint's (private) IP (sets routing)
 #   - snat=1: enables SNAT ip rules
+#   - dropkern=1: drops RST packets generated by the kernel
 #   - txqueuelen=N: sets TX queue
 #   - gre=<> : enable GRE tunnelling - several formats supported
 #   -   gre=true|yes|name : computes GRE key as a hash of slice name (so it's valid across federations)
@@ -115,6 +116,7 @@ if vmask<mask:
 opt_txqueuelen = None
 opt_rp_filter = None
 opt_snat = None
+opt_dropkern = None
 opt_ovs_dp = None
 opt_pointopoint = None
 opt_gre = None
@@ -148,6 +150,10 @@ for optionline in options:
         intval = int(val)
         if val=="1":
             opt_snat = True
+    elif opt=="dropkern":
+        intval = int(val)
+        if val=="1":
+            opt_dropkern = True
     elif opt=="pointopoint":
         opt_pointopoint = val.strip()
         try:
@@ -239,6 +245,8 @@ public_src = os.popen("ifconfig | grep $(ip route | grep default | awk '{print $
 cmd_iptables_pr = "/sbin/iptables -t nat -A POSTROUTING -s %s/%d -j SNAT --to-source %s --random" % (vip, vmask, public_src)
 cmd_iptables_del_pr = "/sbin/iptables -t nat -D POSTROUTING -s %s/%d -j SNAT --to-source %s --random > /dev/null 2>&1" % (vip, vmask, public_src)
 
+cmd_iptables_dk = "/sinb/iptables -I OUTPUT -p tcp -s %s/%d --tcp-flags RST RST -j DROP"%(vip,vmask)
+cmd_iptables_del_dk = "/sinb/iptables -D OUTPUT -p tcp -s %s/%d --tcp-flags RST RST -j DROP"%(vip,vmask)
 
 if opt_gre:
     cmd_gre_setup = "modprobe ip_gre ; ip link add %s type %s remote %s local %s ttl 64 csum key %s" % (
@@ -262,6 +270,10 @@ os.system(cmd_iptables_del_pr)
 if (opt_snat):
     os.system(cmd_iptables_pr)
 
+os.system(cmd_iptables_del_dk)
+if (opt_snat):
+    os.system(cmd_iptables_dk)
+
 # Process additional options
 if opt_rp_filter is not None:
     rp_cmd = "/sbin/sysctl net.ipv4.conf.%s.rp_filter=%s" % (vif, opt_rp_filter)