Default behaviour of IP Options processing
David Schultz
das at FreeBSD.ORG
Thu May 6 17:17:29 PDT 2004
On Thu, May 06, 2004, Andre Oppermann wrote:
> I have just committed the attached change to ip_input() to control the
> behaviour of IP Options processing. The default is the unchanged
> current behaviour.
>
> However I want to propose to change the default from processing options
> to ignoring options (or even stronger to reject them).
I think ignoring IP options by default is a great idea.
However, I have reservations about rejecting packets with
options outright, for two reasons:
- If the options are ignored anyway, it isn't clear that rejecting
packets would buy us additional security. Firewalls are an
exception, but in that case it is more appropriate to block the
packets with a firewall rule.
- Blocking packets could create interoperability issues with other
hosts. For instance, researchers have proposed DOS defenses that
involve placing a nonce in the IP timestamp field. If we're
going to make the Internet a PITA for them to use, there had
better be a good reason for it.
More information about the freebsd-current
mailing list