From beat@chruetertee.ch  Fri Dec 28 13:12:15 2007
Return-Path: <beat@chruetertee.ch>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id F33D016A421
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 28 Dec 2007 13:12:14 +0000 (UTC)
	(envelope-from beat@chruetertee.ch)
Received: from marvin.chruetertee.ch (marvin.chruetertee.ch [217.150.245.55])
	by mx1.freebsd.org (Postfix) with ESMTP id 826D913C4DD
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 28 Dec 2007 13:12:14 +0000 (UTC)
	(envelope-from beat@chruetertee.ch)
Received: from _HOSTNAME_ (BAEe074.bae.pppool.de [77.132.224.116])
	(authenticated bits=0)
	by marvin.chruetertee.ch (8.13.6/8.13.6) with ESMTP id lBSCY4Fw015101
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO)
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 28 Dec 2007 12:34:05 GMT
	(envelope-from beat@chruetertee.ch)
Received: by _HOSTNAME_ (sSMTP sendmail emulation); Fri, 28 Dec 2007 13:34:13 +0100
Message-Id: <200712281234.lBSCY4Fw015101@marvin.chruetertee.ch>
Date: Fri, 28 Dec 2007 13:34:13 +0100
From: "Beat Gaetzi" <beat@chruetertee.ch>
Reply-To: Beat Gtzi <beat@chruetertee.ch>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [PATCH] Remove rc.conf reference to TCP_DROP_SYNFIN kernel option
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         119098
>Category:       conf
>Synopsis:       [PATCH] Remove rc.conf reference to TCP_DROP_SYNFIN kernel option
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    remko
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Fri Dec 28 13:20:01 UTC 2007
>Closed-Date:    Sat Jan 19 17:19:51 UTC 2008
>Last-Modified:  Sat Jan 19 17:19:51 UTC 2008
>Originator:     Beat Gtzi
>Release:        FreeBSD 8.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD daedalus.network.local 8.0-CURRENT FreeBSD 8.0-CURRENT #0: Mon Dec 3 13:00:30 CET 2007 root@daedalus.network.local:/usr/obj/usr/src/sys/GENERIC i386


	
>Description:
	The TCP_DROP_SYNFIN kernel option is now included in the kernel by default.
	Remove reference to this option from defaults/rc.conf and rc.conf(5).
	
>How-To-Repeat:
	
>Fix:

	

--- synfin.patch begins here ---
diff -Naur src.ori/etc/defaults/rc.conf src/etc/defaults/rc.conf
--- src.ori/etc/defaults/rc.conf	2007-10-23 20:36:44.000000000 +0200
+++ src/etc/defaults/rc.conf	2007-12-28 13:12:00.000000000 +0100
@@ -163,8 +163,6 @@
 tcp_extensions="YES"		# Set to NO to turn off RFC1323 extensions.
 log_in_vain="0"			# >=1 to log connects to ports w/o listeners.
 tcp_keepalive="YES"		# Enable stale TCP connection timeout (or NO).
-# For the following option you need to have TCP_DROP_SYNFIN set in your
-# kernel.  Please refer to LINT and NOTES for details.
 tcp_drop_synfin="NO"		# Set to YES to drop TCP packets with SYN+FIN
 				# NOTE: this violates the TCP specification
 icmp_drop_redirect="NO" 	# Set to YES to ignore ICMP REDIRECT packets
diff -Naur src.ori/share/man/man5/rc.conf.5 src/share/man/man5/rc.conf.5
--- src.ori/share/man/man5/rc.conf.5	2007-11-04 18:08:19.000000000 +0100
+++ src/share/man/man5/rc.conf.5	2007-12-28 13:12:48.000000000 +0100
@@ -952,10 +952,6 @@
 the SYN and FIN flags set.
 This prevents OS fingerprinting, but may
 break some legitimate applications.
-This option is only available if the
-kernel was built with the
-.Dv TCP_DROP_SYNFIN
-option.
 .It Va icmp_drop_redirect
 .Pq Vt bool
 Set to
--- synfin.patch ends here ---


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->remko 
Responsible-Changed-By: remko 
Responsible-Changed-When: Fri Dec 28 14:16:12 UTC 2007 
Responsible-Changed-Why:  
I'll take it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=119098 
State-Changed-From-To: open->patched 
State-Changed-By: maxim 
State-Changed-When: Sat Jan 12 20:52:33 UTC 2008 
State-Changed-Why:  
Committed to HEAD.  Thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=119098 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: conf/119098: commit references a PR
Date: Sat, 12 Jan 2008 20:52:36 +0000 (UTC)

 maxim       2008-01-12 20:52:30 UTC
 
   FreeBSD src repository
 
   Modified files:
     etc/defaults         rc.conf 
     share/man/man5       rc.conf.5 
   Log:
   o From the Problem Report: the TCP_DROP_SYNFIN kernel option is now
   included in the kernel by default.  Remove reference to this option
   from defaults/rc.conf and rc.conf(5).
   
   PR:             conf/119098
   Submitted by:   Beat Gaetzi
   MFC after:      1 week
   
   Revision  Changes    Path
   1.322     +0 -2      src/etc/defaults/rc.conf
   1.332     +1 -5      src/share/man/man5/rc.conf.5
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: maxim 
State-Changed-When: Sat Jan 19 17:19:28 UTC 2008 
State-Changed-Why:  
Merged to RELENG_6 and RELENG_7. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=119098 
>Unformatted:
