Re: Default behaviour of IP Options processing

On Thu, May 06, 2004, Andre Oppermann wrote:
> I have just committed the attached change to ip_input() to control the
> behaviour of IP Options processing.  The default is the unchanged
> current behaviour.
> 
> However I want to propose to change the default from processing options
> to ignoring options (or even stronger to reject them).

I think ignoring IP options by default is a great idea.
However, I have reservations about rejecting packets with
options outright, for two reasons:

- If the options are ignored anyway, it isn't clear that rejecting
  packets would buy us additional security.  Firewalls are an
  exception, but in that case it is more appropriate to block the
  packets with a firewall rule.

- Blocking packets could create interoperability issues with other
  hosts.  For instance, researchers have proposed DOS defenses that
  involve placing a nonce in the IP timestamp field.  If we're
  going to make the Internet a PITA for them to use, there had
  better be a good reason for it.