Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 21 Apr 2000 08:48:14 GMT
From:      Salvo Bartolotta <bartequi@neomedia.it>
To:        Matt Heckaman <matt@ARPA.MAIL.NET>, freebsd-questions@FreeBSD.ORG
Subject:   Re: hmm.. restrict_rst & drop_synfin
Message-ID:  <20000421.8481400@bartequi.ottodomain.org>
References:  <Pine.BSF.4.21.0004202258200.73463-100000@epsilon.lucida.qc.ca>

next in thread | previous in thread | raw e-mail | index | archive | help
>>>>>>>>>>>>>>>>>> Original Message <<<<<<<<<<<<<<<<<<

On 4/21/00, 3:59:38 AM, Matt Heckaman <matt@ARPA.MAIL.NET> wrote
regarding Re: hmm.. restrict_rst & drop_synfin:


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1

> On Thu, 20 Apr 2000, Bryan Bradsby wrote:
> [...]
> : You have to compile support for these options into the kernel. They
are
> : not in the GENERIC kernel. See LINT for the proper syntax.

> Yes, I was informed of this shortly after my original post, and I'm
not
> running the generic kernel, I do actually make my own kernels =3D) I a=
m
just
> special kernel options, and that if they did, they should say so. I
> submitted a PR change request to have comments added that state this
and
> one who expected that things listed in defaults/rc.conf would not
require
> refer people to LINT. Thanks

> : -bryan
> :

> Matt Heckaman
> matt@arpa.mail.net
> http://www.lucida.qc.ca

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.1 (FreeBSD)
> Comment: http://www.lucida.qc.ca/pgp

> iD8DBQE4/8QcdMMtMcA1U5ARAiFvAJ9GTYdGse0ZGIfkDElB0k8QFuozpwCfY7Mo
> +AUMAZJ6wWr22HYMtcOYTLk=3D
> =3DIuJ3
> -----END PGP SIGNATURE-----



Dear Matt Heckaman,

These options ARE documented in detail.

From (wait for it) rc.conf(5):

<blockquote>
   tcp_drop_synfin
                   (bool) Set to NO by default.  Setting to YES will
                   cause  the kernel to ignore TCP frames that have
                   both the SYN and FIN flags set. This prevents OS
                   fingerprinting, but may break some legitimate
                   applications. This option is only available
                   if the kernel was built with the TCP_DROP_SYNFIN
                   option.

   tcp_restrict_rst
                   (bool) Set to NO by default.  Setting to YES will
                   cause the kernel to refrain from emitting TCP RST
                   frames in response to invalid TCP packets (e.g.
                   frames destined for closed ports).  This option is
                   only available if the kernel was built with the
                   TCP_RESTRICT_RST option.
</blockquote>

RTFM, RTFM, RTFM ... :-)

This is taken from the man pages on my 3.4-S.=20

The options are documented *where* one is supposed to have a look at=20
before putting hands on rc.conf :-O

However, you are quite right: this is NOT very visible and might=20
mislead people. An additional note in LINT and/or in=20
/etc/defaults/rc.conf should put things right.

I have yet to understand what difference (efficience ? Type and level=20
of action ?), if any, there is between these options and the ipfw=20
firewall rules performing analogous functions (ie deny [...] tcpflags=20
<corresponding_flag>) ...

RTFM, RTFM, RTFM (myself, this time) :-)=20
=20
Best regards,
Salvo                                                                 =20
   =20





To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000421.8481400>