Date: Thu, 06 May 2004 21:16:03 +0200 From: Andre Oppermann <andre@freebsd.org> To: freebsd-current@freebsd.org, freebsd-net@freebsd.org Subject: Default behaviour of IP Options processing Message-ID: <409A8EF3.5825EF0C@freebsd.org> References: <200405061846.i46Ik3Jc060969@repoman.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
I have just committed the attached change to ip_input() to control the behaviour of IP Options processing. The default is the unchanged current behaviour. However I want to propose to change the default from processing options to ignoring options (or even stronger to reject them). The rationale is as follows. IP Options do not have any legitimate use in todays Internet at all. For a long time now we have disabled source routing. The remaining IP Options are RR (record route) and TS (time stamp) which are both useless. For finding out which path a packet takes we use traceroute instead of RR. Besides that RR is limited to the space in the IP Options field and can possibly record only a few hops (9 IIRC). Time stamp is useless for the same reason and since it doesn't have a fixed and synchronized timebase it is even more so useless. Opinions? Discussion? Yes/Nay? -- Andre > andre 2004/05/06 11:46:03 PDT > > FreeBSD src repository > > Modified files: > sys/netinet ip_fastfwd.c ip_input.c ip_var.h > Log: > Provide the sysctl net.inet.ip.process_options to control the processing > of IP options. > > net.inet.ip.process_options=0 Ignore IP options and pass packets unmodified. > net.inet.ip.process_options=1 Process all IP options (default). > net.inet.ip.process_options=2 Reject all packets with IP options with ICMP > filter prohibited message. > > This sysctl affects packets destined for the local host as well as those > only transiting through the host (routing). > > IP options do not have any legitimate purpose anymore and are only used > to circumvent firewalls or to exploit certain behaviours or bugs in TCP/IP > stacks. > > Reviewed by: sam (mentor) > > Revision Changes Path > 1.11 +10 -2 src/sys/netinet/ip_fastfwd.c > 1.271 +13 -0 src/sys/netinet/ip_input.c > 1.87 +1 -0 src/sys/netinet/ip_var.h
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?409A8EF3.5825EF0C>