From owner-freebsd-net@FreeBSD.ORG Thu May 6 15:35:56 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7379916A4CF; Thu, 6 May 2004 15:35:56 -0700 (PDT) Received: from leviathan.inethouston.com (leviathan.inethouston.com [209.198.171.18]) by mx1.FreeBSD.org (Postfix) with ESMTP id CA52443D64; Thu, 6 May 2004 15:35:55 -0700 (PDT) (envelope-from dwcjr@inethouston.net) Received: by leviathan.inethouston.com (Postfix, from userid 1001) id 28B4B2C910E; Thu, 6 May 2004 17:35:45 -0500 (CDT) Date: Thu, 6 May 2004 17:35:45 -0500 From: "David W. Chapman Jr." To: Maxim Konovalov Message-ID: <20040506223545.GA61873@minubian.inethouston.net> Mail-Followup-To: Maxim Konovalov , Andre Oppermann , freebsd-net@freebsd.org, freebsd-current@freebsd.org References: <200405061846.i46Ik3Jc060969@repoman.freebsd.org> <409A8EF3.5825EF0C@freebsd.org> <20040507020422.D94207@mp3files.int.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040507020422.D94207@mp3files.int.ru> User-Agent: Mutt/1.4.2.1i X-Operating-System: FreeBSD 5.2.1-RELEASE-p5 i386 cc: freebsd-net@freebsd.org cc: freebsd-current@freebsd.org cc: Andre Oppermann Subject: Re: Default behaviour of IP Options processing X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "David W. Chapman Jr." List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 May 2004 22:35:56 -0000 > We are using RR option all the time to track down routing asymmetry > and traceroute is not an option, ping -R is very useful in that cases. > We all know that ipfw (and I am sure all other *pf*) is able to > process ip opts quite well and personally see no point in this > sysctls. I fail to see a documentation update (inet.4 ?) as well. > > It is not clear for me why you ever ask for opinions after commit not > before. Strick "nay" if you care :-) He hasn't changed the default yet. But I think for the select few who actually use such tcp options, they can enable it. Most of the users however will not need this. I think the point that is trying to be made is that they want the default installation to be more secure and those who need these features can simply turn them on. -- David W. Chapman Jr. dwcjr@inethouston.net Raintree Network Services, Inc.