Definition of 'send_redirect' in Linux IPv4 context

Question

I've encountered these two lines in a script:

echo "1" > /proc/sys/net/ipv4/ip_forward/
echo "0" > /proc/sys/net/ipv4/conf/eth0/send_redirects

The first line switches on ip forwarding, which makes my machine act like a router.

I would like to understand exactly what the second line does though. It switches off send_redirects on interface eth0 but what does that mean? What is send_redirect in this context?

Solution 1

'ip_forward' is to enable packet forwarding for IPv4.

'Send redirects' is enabled only if the node acts as a router. That is, a host should not send an ICMP Redirect message. It is used by routers to notify the host about a better routing path that is available for a particular destination. Following this, the host updates the route cache entry and forwards the subsequent packets directly over the optimal path/route suggested via ICMP redirect message.

However, this mechanism of routing information updation is risky and is a concern for security community as ICMP redirects can be tampered/faked by malicious software/attacker for redirection to their desired path.

Refer to RFC 1122(Sec 3.3.1 and appendix A) for more details and clauses such as 'A Redirect message SHOULD be silently discarded if the new gateway address it specifies is not on the same connected (sub-) net through which the Redirect arrived or if the source of the Redirect is not the current first-hop gateway for the specified destination'

Solution 2

Redirects happen when you have multiple routers on the same LAN. For example say we have a network with one host and two routers. The host might send a packet to router A and router A might then need to send that packet over the same LAN to router B because it's routing table tells it to. Router A can then send a redirect message to the host to inform it that it would be more efficient if it would send packet for that specific destination directly to router B.

When you turn send_redirect off your router won't send such redirect messages.