RANDOM_IP_ID sysctl?

[Max Laier]

On Tuesday 29 June 2004 15:40, Xin LI wrote:
> On Tue, Jun 29, 2004 at 02:13:38PM +0100, David Malone wrote:
> > It seems to me that RANDOM_IP_ID might be better as a sysctl rather
> > than a kernel option. Would anyone mind if I changed this?

I personally think that RANDOM_IP_ID is something that should be tweakable on 
a per-interface basis (at least). I usually want randomized IDs on my uplink 
interface while it could harm my GigE internal network due to faster ID reuse 
cycles.

FYI, pf(4) can set randomized IDs on a per interface (and even on a per 
connection) basis.

David, I'd appreciate to review your patches in order to avoid breakage of pf, 
thanks.

> Wouldn't this cause a performance penality? IIRC htons() is currently
> a macro which is essentially a no-op, while ip_randomid() is a function
> call. Of course we can convert the call to a uniform hook-alike mechainism,
> however, given the frequency the function is called, this should be
> carefully considered.

One would clearly transform the now present "#ifdef" with "if (sysctlvar) ..." 
and hence this will not incur overhead (one compare is nothing to worry 
about).

> In addition, what's the apparant benefit making it a sysctl rather
> than being a kernel option? I think there is rarely a sysadmin to
> enable and disable this runtime.

One has the freedom to choose without being forced to build its own kernel?

> BTW. For security considerations I'd like to see if this is made default
> in GENERIC kernels :-)

Every user of GigE will tell you else. My vote is clearly against RANDOM_IP_ID 
in GENERIC (as it is right now)! All for the sysctl idea, however, if it is 
done properly and does not break pf(4).

-- 
Best regards,				| mlaier at freebsd.org
Max Laier				| ICQ #67774661
http://pf4freebsd.love2party.net/	| mlaier at EFnet
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: signature
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20040629/7a996341/attachment.bin