Re: Default behaviour of IP Options processing

On Thu, 6 May 2004, 17:35-0500, David W. Chapman Jr. wrote:

> > We are using RR option all the time to track down routing asymmetry
> > and traceroute is not an option, ping -R is very useful in that cases.
> > We all know that ipfw (and I am sure all other *pf*) is able to
> > process ip opts quite well and personally see no point in this
> > sysctls.  I fail to see a documentation update (inet.4 ?) as well.
> >
> > It is not clear for me why you ever ask for opinions after commit not
> > before.  Strick "nay" if you care :-)
>
> He hasn't changed the default yet.  But I think for the select few
> who actually use such tcp options, they can enable it.  Most of the

You mean ip options not tcp, right?  I do not understant why we
invent a new mechanism if we already have one.  Put an example in
/etc/rc.firewall.

> users however will not need this.  I think the point that is trying
> to be made is that they want the default installation to be more
> secure and those who need these features can simply turn them on.

You mean "more obscure", right?  Where net.inet.ip.process_options
documented?  How does it operate with f.e. IPSTEALTH?

-- 
Maxim Konovalov