On 01/28/2011 06:33, Ivo Vachkov wrote:
Hello,
I would like to thank for the help and for the recommendations.
I attach second version of the patch, I proposed earlier, including
following changes:
1) All RFC6056 algorithms are implemented.
2) Both IPv4 and IPv6 stacks are modified to use the new port
randomization code.
3) There are two variables that can be modified via sysctl:
- net.inet.ip.portrange.rfc6056_algorithm - which allows the super
user to choose one out of the five possible algorithms.
- net.inet.ip.portrange.rfc6056_algorithm5_tradeoff - which allows the
super user to modify the trade-off value used in algorithm 5.
All values are explicitly checked for correctness before usage.
Default values for those variables represent current/legacy port
randomization algorithm and proposed values in the RFC itself.
I haven't reviewed the patch in detail yet but I wanted to first thank
you for taking on this work, and being so responsive to Fernando's
request (which I agreed with, and you updated before I even had a chance
to say so). :)
My one comment so far is on the name of the sysctl's. There are 2
problems with sysctl/variable names that use an rfc title. The first is
that they are not very descriptive to the 99.9% of users who are not
familiar with that particular doc. The second is more esoteric, but if
the rfc is subsequently updated or obsoleted we're stuck with either an
anachronism or updating code (both of which have their potential areas
of confusion).
So in order to avoid this issue, and make it more consistent with the
existing:
net.inet.ip.portrange.randomtime
net.inet.ip.portrange.randomcps
net.inet.ip.portrange.randomized
How does net.inet.ip.portrange.randomalg sound? I would also suggest
that the second sysctl be named
net.inet.ip.portrange.randomalg.alg5_tradeoff so that one could do
'sysctl net.inet.ip.portrange.randomalg' and see both values. But I
won't quibble on that. :)
hth,
Doug
--
Nothin' ever doesn't change, but nothin' changes much.
-- OK Go
Breadth of IT experience, and depth of knowledge in the DNS.
Yours for the right price. :) http://SupersetSolutions.com/
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
