From d0b461f524df02aa8766f88dde23c5f4996d8553 Mon Sep 17 00:00:00 2001 From: sullrich Date: Sun, 6 Dec 2009 00:48:32 -0500 Subject: Add lookup table for sysctl tunable (sysctl.inc). Make config.xml values default to value 'default' Ticket #71 --- conf.default/config.xml | 52 ++++++++++++++++++++++++------------------------- etc/inc/sysctl.inc | 40 +++++++++++++++++++++++++++++++++++++ etc/inc/system.inc | 10 +++++++--- 3 files changed, 73 insertions(+), 29 deletions(-) create mode 100644 etc/inc/sysctl.inc diff --git a/conf.default/config.xml b/conf.default/config.xml index 3a306a3..32b4d6f 100644 --- a/conf.default/config.xml +++ b/conf.default/config.xml @@ -8,132 +8,132 @@ Set the ephemeral port range to be lower. net.inet.ip.portrange.first - 1024 + default Drop packets to closed TCP ports without returning a RST net.inet.tcp.blackhole - 2 + default Do not send ICMP port unreachable messages for closed UDP ports net.inet.udp.blackhole - 1 + default Randomize the ID field in IP packets (default is 0: sequential IP IDs) net.inet.ip.random_id - 1 + default Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway) net.inet.tcp.drop_synfin - 1 + default Enable sending IPv4 redirects net.inet.ip.redirect - 1 + default Enable sending IPv6 redirects net.inet6.ip6.redirect - 1 + default Generate SYN cookies for outbound SYN-ACK packets net.inet.tcp.syncookies - 1 + default Maximum incoming/outgoing TCP datagram size (receive) net.inet.tcp.recvspace - 65228 + default Maximum incoming/outgoing TCP datagram size (send) net.inet.tcp.sendspace - 65228 + default IP Fastforwarding net.inet.ip.fastforwarding - 1 + default Do not delay ACK to try and piggyback it onto a data packet net.inet.tcp.delayed_ack - 0 + default Maximum outgoing UDP datagram size net.inet.udp.maxdgram - 57344 + default Handling of non-IP packets which are not passed to pfil (see if_bridge(4)) net.link.bridge.pfil_onlyip - 0 + default Set to 0 to disable filtering on the incoming and outgoing member interfaces. net.link.bridge.pfil_member - 1 + default Set to 1 to enable filtering on the bridge interface net.link.bridge.pfil_bridge - 0 + default Allow unprivileged access to tap(4) device nodes net.link.tap.user_open - 1 + default Verbosity of the rndtest driver (0: do not display results on console) kern.rndtest.verbose - 0 + default Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid()) kern.randompid - 347 + default Maximum size of the IP input queue net.inet.ip.intr_queue_maxlen - 1000 + default Disable CTRL+ALT+Delete reboot from keyboard. hw.syscons.kbd_reboot - 0 + default Enable TCP Inflight mode net.inet.tcp.inflight.enable - 1 + default Enable TCP extended debugging net.inet.tcp.log_debug - 0 + default Set ICMP Limits net.inet.icmp.icmplim - 750 + default TCP Offload Engine net.inet.tcp.tso - 0 + default TCP Offload Engine - BCE hw.bce.tso_enable - 0 + default diff --git a/etc/inc/sysctl.inc b/etc/inc/sysctl.inc new file mode 100644 index 0000000..c90b074 --- /dev/null +++ b/etc/inc/sysctl.inc @@ -0,0 +1,40 @@ + "1024", + "net.inet.tcp.blackhole" => "2", + "net.inet.udp.blackhole" => "1", + "net.inet.ip.random_id" => "1", + "net.inet.tcp.drop_synfin" => "1", + "net.inet.ip.redirect" => "1", + "net.inet6.ip6.redirect" => "1", + "net.inet.tcp.syncookies" => "1", + "net.inet.tcp.recvspace" => "65228", + "net.inet.tcp.sendspace" => "65228", + "net.inet.ip.fastforwarding" => "1", + "net.inet.tcp.delayed_ack" => "0", + "net.inet.udp.maxdgram" => "57344", + "net.link.bridge.pfil_onlyip" => "0", + "net.link.bridge.pfil_member" => "1", + "net.link.bridge.pfil_bridge" => "0", + "net.link.tap.user_open" => "1", + "kern.rndtest.verbose" => "0", + "kern.randompid" => "347", + "net.inet.ip.intr_queue_maxlen" => "1000", + "hw.syscons.kbd_reboot" => "0", + "net.inet.tcp.inflight.enable" => "1", + "net.inet.tcp.log_debug" => "0", + "net.inet.icmp.icmplim" => "750", + "net.inet.tcp.tso" => "0", + "hw.bce.tso_enable" => "0" + ); + +function get_default_sysctl_value($id) { + global $sysctls; + foreach($sysctls as $sysctl => $value) { + if($sysctl == $id) + return $value; + } +} + + +?> \ No newline at end of file diff --git a/etc/inc/system.inc b/etc/inc/system.inc index dd54527..e3611ea 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -50,16 +50,20 @@ function activate_powerd() { function activate_sysctls() { global $config, $g; - + require("sysctl.inc"); exec("/sbin/sysctl net.enc.out.ipsec_bpf_mask=0x00000001"); exec("/sbin/sysctl net.enc.out.ipsec_filter_mask=0x00000001"); exec("/sbin/sysctl net.enc.in.ipsec_bpf_mask=0x00000002"); exec("/sbin/sysctl net.enc.in.ipsec_filter_mask=0x00000002"); - if (is_array($config['sysctl'])) - foreach ($config['sysctl']['item'] as $tunable) + if (is_array($config['sysctl'])) { + foreach ($config['sysctl']['item'] as $tunable) { + if($tunable['value'] == "default") + $tunable['value'] = get_default_sysctl_value($tunable['tunable']); mwexec("sysctl " . $tunable['tunable'] . "=\"" . $tunable['value'] . "\""); + } + } } function system_resolvconf_generate($dynupdate = false) { -- cgit v1.1