From e46cd3d4d2fb7232a6500e268cdb04e43461afbd Mon Sep 17 00:00:00 2001
From: Dag-Erling Smørgrav <des@FreeBSD.org>
Date: Sun, 12 Sep 1999 17:22:08 +0000
Subject: Add the net.inet.tcp.restrict_rst and net.inet.tcp.drop_synfin sysctl
 variables, conditional on the TCP_RESTRICT_RST and TCP_DROP_SYNFIN kernel
 options, respectively. See the comments in LINT for details.

---
 etc/rc.d/netoptions | 10 ++++++++++
 etc/rc.d/network1   | 10 ++++++++++
 etc/rc.d/network2   | 10 ++++++++++
 etc/rc.d/network3   | 10 ++++++++++
 etc/rc.d/routing    | 10 ++++++++++
 5 files changed, 50 insertions(+)

(limited to 'etc/rc.d')

diff --git a/etc/rc.d/netoptions b/etc/rc.d/netoptions
index d1325255b4b9..781c73f11f1a 100644
--- a/etc/rc.d/netoptions
+++ b/etc/rc.d/netoptions
@@ -229,6 +229,16 @@ network_pass1() {
 	    sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null
     fi
 
+    if [ "X$tcp_restrict_rst" = X"YES" ]; then
+	    echo -n ' restrict TCP reset=YES'
+	    sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null
+    fi
+
+    if [ "X$tcp_drop_synfin" = X"YES" ]; then
+	    echo -n ' drop SYN+FIN packets=YES'
+	    sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null
+    fi
+
     if [ "${ipxgateway_enable}" = "YES" ]; then
 	    echo -n ' IPX gateway=YES'
 	    sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null
diff --git a/etc/rc.d/network1 b/etc/rc.d/network1
index d1325255b4b9..781c73f11f1a 100644
--- a/etc/rc.d/network1
+++ b/etc/rc.d/network1
@@ -229,6 +229,16 @@ network_pass1() {
 	    sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null
     fi
 
+    if [ "X$tcp_restrict_rst" = X"YES" ]; then
+	    echo -n ' restrict TCP reset=YES'
+	    sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null
+    fi
+
+    if [ "X$tcp_drop_synfin" = X"YES" ]; then
+	    echo -n ' drop SYN+FIN packets=YES'
+	    sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null
+    fi
+
     if [ "${ipxgateway_enable}" = "YES" ]; then
 	    echo -n ' IPX gateway=YES'
 	    sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null
diff --git a/etc/rc.d/network2 b/etc/rc.d/network2
index d1325255b4b9..781c73f11f1a 100644
--- a/etc/rc.d/network2
+++ b/etc/rc.d/network2
@@ -229,6 +229,16 @@ network_pass1() {
 	    sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null
     fi
 
+    if [ "X$tcp_restrict_rst" = X"YES" ]; then
+	    echo -n ' restrict TCP reset=YES'
+	    sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null
+    fi
+
+    if [ "X$tcp_drop_synfin" = X"YES" ]; then
+	    echo -n ' drop SYN+FIN packets=YES'
+	    sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null
+    fi
+
     if [ "${ipxgateway_enable}" = "YES" ]; then
 	    echo -n ' IPX gateway=YES'
 	    sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null
diff --git a/etc/rc.d/network3 b/etc/rc.d/network3
index d1325255b4b9..781c73f11f1a 100644
--- a/etc/rc.d/network3
+++ b/etc/rc.d/network3
@@ -229,6 +229,16 @@ network_pass1() {
 	    sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null
     fi
 
+    if [ "X$tcp_restrict_rst" = X"YES" ]; then
+	    echo -n ' restrict TCP reset=YES'
+	    sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null
+    fi
+
+    if [ "X$tcp_drop_synfin" = X"YES" ]; then
+	    echo -n ' drop SYN+FIN packets=YES'
+	    sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null
+    fi
+
     if [ "${ipxgateway_enable}" = "YES" ]; then
 	    echo -n ' IPX gateway=YES'
 	    sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null
diff --git a/etc/rc.d/routing b/etc/rc.d/routing
index d1325255b4b9..781c73f11f1a 100644
--- a/etc/rc.d/routing
+++ b/etc/rc.d/routing
@@ -229,6 +229,16 @@ network_pass1() {
 	    sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null
     fi
 
+    if [ "X$tcp_restrict_rst" = X"YES" ]; then
+	    echo -n ' restrict TCP reset=YES'
+	    sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null
+    fi
+
+    if [ "X$tcp_drop_synfin" = X"YES" ]; then
+	    echo -n ' drop SYN+FIN packets=YES'
+	    sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null
+    fi
+
     if [ "${ipxgateway_enable}" = "YES" ]; then
 	    echo -n ' IPX gateway=YES'
 	    sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null
-- 
cgit v1.3