d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Axe TCP_RESTRICT_RST. It was never a particularly good idea except for a few

Browse Source 
very specific scenarios, and now that we have had net.inet.tcp.blackhole for
quite some time there is really no reason to use it any more.

(first of three commits)
This commit is contained in:
Dag-Erling Smørgrav 2001-03-19 22:03:11 +00:00
parent 6371776c8e
commit 11b876c98e
3 changed files with 0 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/conf/NOTES
View File

@ -590,19 +590,11 @@ options TCPDEBUG
options ACCEPT_FILTER_DATA
options ACCEPT_FILTER_HTTP
# The following options add sysctl variables for controlling how certain
# TCP packets are handled.
#
# TCP_DROP_SYNFIN adds support for ignoring TCP packets with SYN+FIN. This
# prevents nmap et al. from identifying the TCP/IP stack, but breaks support
# for RFC1644 extensions and is not recommended for web servers.
#
# TCP_RESTRICT_RST adds support for blocking the emission of TCP RST packets.
# This is useful on systems which are exposed to SYN floods (e.g. IRC servers)
# or any system which one does not want to be easily portscannable.
#
options TCP_DROP_SYNFIN #drop TCP packets with SYN+FIN
options TCP_RESTRICT_RST #restrict emission of TCP RST
# DUMMYNET enables the "dummynet" bandwidth limiter. You need
# IPFIREWALL as well. See the dummynet(4) manpage for more info.

1
sys/conf/options
View File

@ -278,7 +278,6 @@ SLIP_IFF_OPTS opt_slip.h
TCP_COMPAT_42 opt_compat.h
TCPDEBUG
TCP_DROP_SYNFIN opt_tcp_input.h
TCP_RESTRICT_RST opt_tcp_input.h
XBONEHACK
# Netgraph(4). Use option NETGRAPH to enable the base netgraph code.

8
sys/i386/conf/NOTES
View File

@ -590,19 +590,11 @@ options TCPDEBUG
options ACCEPT_FILTER_DATA
options ACCEPT_FILTER_HTTP
# The following options add sysctl variables for controlling how certain
# TCP packets are handled.
#
# TCP_DROP_SYNFIN adds support for ignoring TCP packets with SYN+FIN. This
# prevents nmap et al. from identifying the TCP/IP stack, but breaks support
# for RFC1644 extensions and is not recommended for web servers.
#
# TCP_RESTRICT_RST adds support for blocking the emission of TCP RST packets.
# This is useful on systems which are exposed to SYN floods (e.g. IRC servers)
# or any system which one does not want to be easily portscannable.
#
options TCP_DROP_SYNFIN #drop TCP packets with SYN+FIN
options TCP_RESTRICT_RST #restrict emission of TCP RST
# DUMMYNET enables the "dummynet" bandwidth limiter. You need
# IPFIREWALL as well. See the dummynet(4) manpage for more info.