cvs commit: src/sys/netinet tcp_syncache.c

[Mike Silbersack]

On Wed, 23 Jan 2008, Andre Oppermann wrote:

> OTOH the enforcement of this rule wasn't really there before and it
> may be argued that we've got a POLA violation here.  A careful reading

That's exactly the point.  We were not enforcing timestamps since... 
whenever the RFC1323 code went in.  Then we start enforcing them, and 
start getting bug reports while we're still in the beta phase.  That 
indicates to me that we would've been likely to see many reports as time 
went on.

If you want to put the check back in, but hide it behind a sysctl that is 
disabled by default, that would be ok with me.

I'm not generally opposed to security improvements that only affect edge 
cases... but being unable to connect is not an edge case!

-Mike