回复: How to disable tryforward ?

[k simon]

     Enable "net.inet.ip.redirect" or patched ip_fastfwd.c  tryforward() with "return m;" ,I've tested it yet, but ECMP is not sucessed. Even tried patched ip_input.c with :
--- ip_input.c.orig     2019-10-26 20:33:21.468834000 +0800
+++ ip_input.c  2019-10-26 20:05:57.523372000 +0800
@@ -566,6 +566,7 @@
         * case skip another inbound firewall processing and update
         * ip pointer.
         */
+#ifndef RADIX_MPATH
        if (V_ipforwarding != 0 && V_ipsendredirects == 0
 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
            && (!IPSEC_ENABLED(ipv4) ||
@@ -580,6 +581,7 @@
                        goto ours;
                }
        }
+#endif

 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
        /*

But it's strange, packets from local do ECMP as expect, other packets (not local, just forward) stick to the first route entry as before.  Maybe the problem is not only related with tryforwad().

  # uname -a
FreeBSD orignal 12.1-STABLE FreeBSD 12.1-STABLE #0 r354079M: Sat Oct 26 19:17:03 CST 2019     root at orignal:/usr/obj/usr/src/amd64.amd64/sys/fb12-r354016-v4  amd64

Simon Ke
20191026
________________________________
发件人: Andrey V. Elsukov <bu7cher at yandex.ru>
发送时间: 2019年10月25日 11:31
收件人: k simon <moremore2 at outlook.com>; freebsd-net at freebsd.org <freebsd-net at freebsd.org>
主题: Re: How to disable tryforward ?

On 22.10.2019 08:38, k simon wrote:
> Hi,
> Tryforwad have merged 3 yeas ago, and  it haven’t a sysctl to disable it , so ECMP was broken past 3 years. Olivier has fired a bug : https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225792 , it seems that a few of people cares it.
> Andrey said maybe some ipsec policy can disable tryforward.( https://lists.freebsd.org/pipermail/freebsd-net/2017-February/047203.html. ) I have tried a lot configurations,  but  failed. Can someone point it out ?
> Thanks!

AFAIR, tryforward was disabled by default later.
You need to disable icmpredirects to enable tryforward. So, if you don't
need tryforward, just enable ICMP redirects.

--
WBR, Andrey V. Elsukov