Implement support for RFC 3514 (The Security Flag in the IPv4 Header).

(See: ftp://ftp.rfc-editor.org/in-notes/rfc3514.txt)

This fulfills the host requirements for userland support by
way of the setsockopt() IP_EVIL_INTENT message.

There are three sysctl tunables provided to govern system behavior.

	net.inet.ip.rfc3514:

		Enables support for rfc3514.  As this is an
		Informational RFC and support is not yet widespread
		this option is disabled by default.

	net.inet.ip.hear_no_evil

		 If set the host will discard all received evil packets.

	net.inet.ip.speak_no_evil

		If set the host will discard all transmitted evil packets.

The IP statistics counter 'ips_evil' (available via 'netstat') provides
information on the number of 'evil' packets recieved.

For reference, the '-E' option to 'ping' has been provided to demonstrate
and test the implementation.

1 files changed, 11 insertions, 0 deletions

diff --git a/share/man/man4/inet.4 b/share/man/man4/inet.4
index d15c204..3cf03f8 100644
--- a/share/man/man4/inet.4
+++ b/share/man/man4/inet.4
@@ -261,6 +261,17 @@ adaptation described above.
 .Pq ip.rtmaxcache
 Integer: trigger level of cached, unreferenced, protocol-cloned routes
 which initiates dynamic adaptation (default 128).
+.It Dv IPCTL_RFC3514
+.Pq ip.rfc3514
+Boolean: Enable support for RFC3514.  Defaults to off.
+.It Dv IPCTL_SPEAK_NO_EVIL
+.Pq ip.speak_no_evil
+Boolean: Prevent the transmission of RFC3514 (EVIL) packets.
+Defaults to off.
+.It Dv IPCTL_HEAR_NO_EVIL
+.Pq ip.hear_no_evil
+Boolean: Prevent the reception of RFC3514 (EVIL) packets.
+Defaults to off.
 .El
 .Sh SEE ALSO
 .Xr ioctl 2 ,