summaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
authordes <des@FreeBSD.org>1999-08-10 09:45:33 +0000
committerdes <des@FreeBSD.org>1999-08-10 09:45:33 +0000
commit25571d959a24b27ad016d62787a175ec852d877c (patch)
tree5b8c4ddd11ff71d3883d1d43bcddeb294024ef33 /etc
parent59930ac9dda05f451a71df527030658917e79da7 (diff)
downloadFreeBSD-src-25571d959a24b27ad016d62787a175ec852d877c.zip
FreeBSD-src-25571d959a24b27ad016d62787a175ec852d877c.tar.gz
Add net.inet.icmp.log_redirect and net.inet.icmp.drop_redirect, for
respectively logging and dropping ICMP REDIRECT packets. Note that there is no rate limiting on the log messages, so log_redirect should be used with caution (preferrably only for debugging purposes).
Diffstat (limited to 'etc')
-rw-r--r--etc/defaults/rc.conf4
-rw-r--r--etc/network.subr12
-rw-r--r--etc/rc.d/netoptions12
-rw-r--r--etc/rc.d/network112
-rw-r--r--etc/rc.d/network212
-rw-r--r--etc/rc.d/network312
-rw-r--r--etc/rc.d/routing12
-rw-r--r--etc/rc.network12
8 files changed, 80 insertions, 8 deletions
diff --git a/etc/defaults/rc.conf b/etc/defaults/rc.conf
index ab8e8b3..e80b0e8 100644
--- a/etc/defaults/rc.conf
+++ b/etc/defaults/rc.conf
@@ -9,7 +9,7 @@
#
# All arguments must be in double or single quotes.
#
-# $Id: rc.conf,v 1.23 1999/07/26 10:49:33 brian Exp $
+# $Id: rc.conf,v 1.24 1999/08/03 10:11:02 eivind Exp $
##############################################################
### Important initial Boot-time options ####################
@@ -48,6 +48,8 @@ natd_flags="" # Additional flags for natd.
tcp_extensions="NO" # Set to Yes to turn on RFC1323 extensions.
log_in_vain="NO" # Disallow bad connection logging (or YES).
tcp_keepalive="YES" # Kill dead TCP connections (or NO).
+icmp_drop_redirect="NO" # Set to YES to ignore ICMP REDIRECT packets
+icmp_log_redirect="NO" # Set to YES to log ICMP REDIRECT packets
network_interfaces="auto" # List of network interfaces (or "auto").
ifconfig_lo0="inet 127.0.0.1" # default loopback device configuration.
#ifconfig_lo0_alias0="inet 127.0.0.254 netmask 0xffffffff" # Sample alias entry.
diff --git a/etc/network.subr b/etc/network.subr
index 946e66c..ba40c16 100644
--- a/etc/network.subr
+++ b/etc/network.subr
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $Id: rc.network,v 1.51 1999/07/26 10:49:31 brian Exp $
+# $Id: rc.network,v 1.52 1999/07/26 15:17:23 brian Exp $
# From: @(#)netstart 5.9 (Berkeley) 3/30/91
# Note that almost all the user-configurable behavior is no longer in
@@ -197,6 +197,16 @@ network_pass1() {
echo -n ' broadcast ping responses=YES'
sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
fi
+
+ if [ "X$icmp_drop_redirect" = X"YES" ]; then
+ echo -n ' ignore ICMP redirect=YES'
+ sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
+ fi
+
+ if [ "X$icmp_log_redirect" = X"YES" ]; then
+ echo -n ' log ICMP redirect=YES'
+ sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
+ fi
if [ "X$gateway_enable" = X"YES" ]; then
echo -n ' IP gateway=YES'
diff --git a/etc/rc.d/netoptions b/etc/rc.d/netoptions
index 946e66c..ba40c16 100644
--- a/etc/rc.d/netoptions
+++ b/etc/rc.d/netoptions
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $Id: rc.network,v 1.51 1999/07/26 10:49:31 brian Exp $
+# $Id: rc.network,v 1.52 1999/07/26 15:17:23 brian Exp $
# From: @(#)netstart 5.9 (Berkeley) 3/30/91
# Note that almost all the user-configurable behavior is no longer in
@@ -197,6 +197,16 @@ network_pass1() {
echo -n ' broadcast ping responses=YES'
sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
fi
+
+ if [ "X$icmp_drop_redirect" = X"YES" ]; then
+ echo -n ' ignore ICMP redirect=YES'
+ sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
+ fi
+
+ if [ "X$icmp_log_redirect" = X"YES" ]; then
+ echo -n ' log ICMP redirect=YES'
+ sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
+ fi
if [ "X$gateway_enable" = X"YES" ]; then
echo -n ' IP gateway=YES'
diff --git a/etc/rc.d/network1 b/etc/rc.d/network1
index 946e66c..ba40c16 100644
--- a/etc/rc.d/network1
+++ b/etc/rc.d/network1
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $Id: rc.network,v 1.51 1999/07/26 10:49:31 brian Exp $
+# $Id: rc.network,v 1.52 1999/07/26 15:17:23 brian Exp $
# From: @(#)netstart 5.9 (Berkeley) 3/30/91
# Note that almost all the user-configurable behavior is no longer in
@@ -197,6 +197,16 @@ network_pass1() {
echo -n ' broadcast ping responses=YES'
sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
fi
+
+ if [ "X$icmp_drop_redirect" = X"YES" ]; then
+ echo -n ' ignore ICMP redirect=YES'
+ sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
+ fi
+
+ if [ "X$icmp_log_redirect" = X"YES" ]; then
+ echo -n ' log ICMP redirect=YES'
+ sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
+ fi
if [ "X$gateway_enable" = X"YES" ]; then
echo -n ' IP gateway=YES'
diff --git a/etc/rc.d/network2 b/etc/rc.d/network2
index 946e66c..ba40c16 100644
--- a/etc/rc.d/network2
+++ b/etc/rc.d/network2
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $Id: rc.network,v 1.51 1999/07/26 10:49:31 brian Exp $
+# $Id: rc.network,v 1.52 1999/07/26 15:17:23 brian Exp $
# From: @(#)netstart 5.9 (Berkeley) 3/30/91
# Note that almost all the user-configurable behavior is no longer in
@@ -197,6 +197,16 @@ network_pass1() {
echo -n ' broadcast ping responses=YES'
sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
fi
+
+ if [ "X$icmp_drop_redirect" = X"YES" ]; then
+ echo -n ' ignore ICMP redirect=YES'
+ sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
+ fi
+
+ if [ "X$icmp_log_redirect" = X"YES" ]; then
+ echo -n ' log ICMP redirect=YES'
+ sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
+ fi
if [ "X$gateway_enable" = X"YES" ]; then
echo -n ' IP gateway=YES'
diff --git a/etc/rc.d/network3 b/etc/rc.d/network3
index 946e66c..ba40c16 100644
--- a/etc/rc.d/network3
+++ b/etc/rc.d/network3
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $Id: rc.network,v 1.51 1999/07/26 10:49:31 brian Exp $
+# $Id: rc.network,v 1.52 1999/07/26 15:17:23 brian Exp $
# From: @(#)netstart 5.9 (Berkeley) 3/30/91
# Note that almost all the user-configurable behavior is no longer in
@@ -197,6 +197,16 @@ network_pass1() {
echo -n ' broadcast ping responses=YES'
sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
fi
+
+ if [ "X$icmp_drop_redirect" = X"YES" ]; then
+ echo -n ' ignore ICMP redirect=YES'
+ sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
+ fi
+
+ if [ "X$icmp_log_redirect" = X"YES" ]; then
+ echo -n ' log ICMP redirect=YES'
+ sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
+ fi
if [ "X$gateway_enable" = X"YES" ]; then
echo -n ' IP gateway=YES'
diff --git a/etc/rc.d/routing b/etc/rc.d/routing
index 946e66c..ba40c16 100644
--- a/etc/rc.d/routing
+++ b/etc/rc.d/routing
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $Id: rc.network,v 1.51 1999/07/26 10:49:31 brian Exp $
+# $Id: rc.network,v 1.52 1999/07/26 15:17:23 brian Exp $
# From: @(#)netstart 5.9 (Berkeley) 3/30/91
# Note that almost all the user-configurable behavior is no longer in
@@ -197,6 +197,16 @@ network_pass1() {
echo -n ' broadcast ping responses=YES'
sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
fi
+
+ if [ "X$icmp_drop_redirect" = X"YES" ]; then
+ echo -n ' ignore ICMP redirect=YES'
+ sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
+ fi
+
+ if [ "X$icmp_log_redirect" = X"YES" ]; then
+ echo -n ' log ICMP redirect=YES'
+ sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
+ fi
if [ "X$gateway_enable" = X"YES" ]; then
echo -n ' IP gateway=YES'
diff --git a/etc/rc.network b/etc/rc.network
index 946e66c..ba40c16 100644
--- a/etc/rc.network
+++ b/etc/rc.network
@@ -1,6 +1,6 @@
#!/bin/sh -
#
-# $Id: rc.network,v 1.51 1999/07/26 10:49:31 brian Exp $
+# $Id: rc.network,v 1.52 1999/07/26 15:17:23 brian Exp $
# From: @(#)netstart 5.9 (Berkeley) 3/30/91
# Note that almost all the user-configurable behavior is no longer in
@@ -197,6 +197,16 @@ network_pass1() {
echo -n ' broadcast ping responses=YES'
sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
fi
+
+ if [ "X$icmp_drop_redirect" = X"YES" ]; then
+ echo -n ' ignore ICMP redirect=YES'
+ sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
+ fi
+
+ if [ "X$icmp_log_redirect" = X"YES" ]; then
+ echo -n ' log ICMP redirect=YES'
+ sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
+ fi
if [ "X$gateway_enable" = X"YES" ]; then
echo -n ' IP gateway=YES'
OpenPOWER on IntegriCloud