Blame SOURCES/0029-docs-conf-note-that-IPv6_rpfilter-has-a-performance-.patch

47f735
From 6e97c635d2bfe9ef73f72aa165443cfcefc6c82c Mon Sep 17 00:00:00 2001
47f735
From: Eric Garver <eric@garver.life>
47f735
Date: Mon, 17 May 2021 15:43:13 -0400
47f735
Subject: [PATCH 29/30] docs(conf): note that IPv6_rpfilter has a performance
47f735
 penalty
47f735
47f735
Fixes: rhbz 1871860
47f735
(cherry picked from commit aad59154e16f669bf85e9894e7e0e19061d370d4)
47f735
(cherry picked from commit 5391c26d3e730f283d1f00f7ac1869aeb2251837)
47f735
---
47f735
 doc/xml/firewalld.conf.xml | 9 +++++++++
47f735
 1 file changed, 9 insertions(+)
47f735
47f735
diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
47f735
index c21ef87813bc..0bf4c2d4d011 100644
47f735
--- a/doc/xml/firewalld.conf.xml
47f735
+++ b/doc/xml/firewalld.conf.xml
47f735
@@ -114,6 +114,15 @@
47f735
 	    If a reply to the packet would be sent via the same interface that the packet arrived on, the packet will match and be accepted, otherwise dropped.
47f735
             For IPv4 the rp_filter is controlled using sysctl.
47f735
 	  </para>
47f735
+      <para>
47f735
+        <emphasis role="bold">Note</emphasis>: This feature has a performance
47f735
+        impact. In most cases the impact is not enough to cause a noticeable
47f735
+        difference. It requires route lookups and its execution occurs before
47f735
+        the established connections fast path. As such it can have a
47f735
+        significant performance impact if there is a lot of traffic. It's
47f735
+        enabled by default for security, but can be disabled if performance is
47f735
+        a concern.
47f735
+      </para>
47f735
 	</listitem>
47f735
       </varlistentry>
47f735
 
47f735
-- 
47f735
2.27.0
47f735