Page MenuHomeFreeBSD

Disable ICMP (v4) redirects by default
Needs ReviewPublic

Authored by emaste on May 6 2024, 3:14 PM.
Tags
None
Referenced Files
F99603175: D45102.diff
Fri, Oct 11, 5:45 AM
F99582095: D45102.diff
Fri, Oct 11, 12:31 AM
Unknown Object (File)
Thu, Oct 10, 8:08 AM
Unknown Object (File)
Tue, Oct 8, 11:44 PM
Unknown Object (File)
Tue, Oct 8, 1:04 PM
Unknown Object (File)
Mon, Oct 7, 2:43 PM
Unknown Object (File)
Sun, Oct 6, 5:05 AM
Unknown Object (File)
Thu, Oct 3, 9:00 AM

Details

Summary

Relnotes: Yes

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

emaste requested review of this revision.May 6 2024, 3:14 PM

Based on discussion on a recent secteam call. After putting this together I discovered D23329, which provides an rc.conf setting defaulting to AUTO which is set to yes (drop) if a routing daemon is enabled, and no if not - so if we do want to make this change we'll want to update rc.d/routing as well.

CC @donner and @melifaro.

I agree that this default is a long due to be changed. Needs to be mentioned in Release Notes, though.

switch userland default as well

libexec/rc/rc.d/routing
341

I don't think there's an issue with just changing the var itself from AUTO to YES (i.e., avoiding the underscore-prefixed dance)

ceri added inline comments.
libexec/rc/rc.d/routing
340

Is the |โ€โ€ still appropriate?
It seems to have the wrong default behaviour if this is somehow unset.

libexec/rc/rc.d/routing
340

Default is now yes, so choosing yes if unset seems appropriate?

libexec/rc/rc.d/routing
340

A very fine point; was reading backwards.

rgrimes added inline comments.
libexec/rc/rc.d/routing
341

For systems doing "updates" just switching auto to yes *may* break some installations.

libexec/rc/rc.d/routing
341

That's kind of the point here. At some point we have to break some eggs. We will doing this for 15 and not intending to MFC. It will be a release note item.

346

Should we print this on the yes case given it is now the default?

libexec/rc/rc.d/routing
346

Hrm, good question. This is one of the unfortunate side effects of negative-sense sysctls; we print a message in all of the "= 1" cases so there's some argument for keeping that for consistency. We could instead print ignore ICMP redirect=NO in the no case I suppose.

libexec/rc/rc.d/routing
341

Also note that redirects are a performance optimization, if a system changes to yes after upgrade it won't "break" in the sense of network unreachability.