Relnotes: Yes
Diff Detail
- Lint
Lint Skipped - Unit
Tests Skipped
Event Timeline
Based on discussion on a recent secteam call. After putting this together I discovered D23329, which provides an rc.conf setting defaulting to AUTO which is set to yes (drop) if a routing daemon is enabled, and no if not - so if we do want to make this change we'll want to update rc.d/routing as well.
I agree that this default is a long due to be changed. Needs to be mentioned in Release Notes, though.
libexec/rc/rc.d/routing | ||
---|---|---|
341 | I don't think there's an issue with just changing the var itself from AUTO to YES (i.e., avoiding the underscore-prefixed dance) |
libexec/rc/rc.d/routing | ||
---|---|---|
340 | Is the |โโ still appropriate? |
libexec/rc/rc.d/routing | ||
---|---|---|
340 | Default is now yes, so choosing yes if unset seems appropriate? |
libexec/rc/rc.d/routing | ||
---|---|---|
340 | A very fine point; was reading backwards. |
libexec/rc/rc.d/routing | ||
---|---|---|
341 | For systems doing "updates" just switching auto to yes *may* break some installations. |
libexec/rc/rc.d/routing | ||
---|---|---|
346 | Hrm, good question. This is one of the unfortunate side effects of negative-sense sysctls; we print a message in all of the "= 1" cases so there's some argument for keeping that for consistency. We could instead print ignore ICMP redirect=NO in the no case I suppose. |
libexec/rc/rc.d/routing | ||
---|---|---|
341 | Also note that redirects are a performance optimization, if a system changes to yes after upgrade it won't "break" in the sense of network unreachability. |