mirror of
https://git.FreeBSD.org/src.git
synced 2024-12-25 11:37:56 +00:00
173c0f9f5c
o Drop all broadcast and multicast source addresses in tcp_input. o Enable ICMP_BANDLIM in GENERIC. o Change default to 200/s from 100/s. This will still stop the attack, but is conservative enough to do this close to code freeze. This is not the optimal patch for the problem, but is likely the least intrusive patch that can be made for this. Obtained from: Don Lewis and Matt Dillon. Reviewed by: freebsd-security
227 lines
7.6 KiB
Plaintext
227 lines
7.6 KiB
Plaintext
#
|
|
# GENERIC -- Generic kernel configuration file for FreeBSD/i386
|
|
#
|
|
# For more information on this file, please read the handbook section on
|
|
# Kernel Configuration Files:
|
|
#
|
|
# http://www.freebsd.org/handbook/kernelconfig-config.html
|
|
#
|
|
# The handbook is also available locally in /usr/share/doc/handbook
|
|
# if you've installed the doc distribution, otherwise always see the
|
|
# FreeBSD World Wide Web server (http://www.FreeBSD.ORG/) for the
|
|
# latest information.
|
|
#
|
|
# An exhaustive list of options and more detailed explanations of the
|
|
# device lines is also present in the ./LINT configuration file. If you are
|
|
# in doubt as to the purpose or necessity of a line, check first in LINT.
|
|
#
|
|
# $FreeBSD$
|
|
|
|
machine i386
|
|
cpu I386_CPU
|
|
cpu I486_CPU
|
|
cpu I586_CPU
|
|
cpu I686_CPU
|
|
ident GENERIC
|
|
maxusers 32
|
|
|
|
#makeoptions DEBUG=-g #Build kernel with gdb(1) debug symbols
|
|
|
|
options MATH_EMULATE #Support for x87 emulation
|
|
options INET #InterNETworking
|
|
options FFS #Berkeley Fast Filesystem
|
|
options FFS_ROOT #FFS usable as root device [keep this!]
|
|
options MFS #Memory Filesystem
|
|
options MD_ROOT #MD is a potential root device
|
|
options NFS #Network Filesystem
|
|
options NFS_ROOT #NFS usable as root device, NFS required
|
|
options MSDOSFS #MSDOS Filesystem
|
|
options CD9660 #ISO 9660 Filesystem
|
|
options CD9660_ROOT #CD-ROM usable as root, CD9660 required
|
|
options PROCFS #Process filesystem
|
|
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
|
|
options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
|
|
options UCONSOLE #Allow users to grab the console
|
|
options USERCONFIG #boot -c editor
|
|
options VISUAL_USERCONFIG #visual boot -c editor
|
|
options KTRACE #ktrace(1) support
|
|
options SYSVSHM #SYSV-style shared memory
|
|
options SYSVMSG #SYSV-style message queues
|
|
options SYSVSEM #SYSV-style semaphores
|
|
options P1003_1B #Posix P1003_1B real-time extentions
|
|
options _KPOSIX_PRIORITY_SCHEDULING
|
|
options _KPOSIX_VERSION=199309L
|
|
options ICMP_BANDLIM # Rate limit bad replies
|
|
|
|
# To make an SMP kernel, the next two are needed
|
|
#options SMP # Symmetric MultiProcessor Kernel
|
|
#options APIC_IO # Symmetric (APIC) I/O
|
|
# Optionally these may need tweaked, (defaults shown):
|
|
#options NCPU=2 # number of CPUs
|
|
#options NBUS=4 # number of busses
|
|
#options NAPIC=1 # number of IO APICs
|
|
#options NINTR=24 # number of INTs
|
|
|
|
device isa
|
|
device eisa
|
|
device pci
|
|
|
|
# Floppy drives
|
|
device fdc0 at isa? port IO_FD1 irq 6 drq 2
|
|
device fd0 at fdc0 drive 0
|
|
device fd1 at fdc0 drive 1
|
|
|
|
# ATA and ATAPI devices
|
|
device ata0 at isa? port IO_WD1 irq 14
|
|
device ata1 at isa? port IO_WD2 irq 15
|
|
device ata
|
|
device atadisk # ATA disk drives
|
|
device atapicd # ATAPI CDROM drives
|
|
device atapifd # ATAPI floppy drives
|
|
device atapist # ATAPI tape drives
|
|
options ATA_STATIC_ID #Static device numbering
|
|
#options ATA_ENABLE_ATAPI_DMA #Enable DMA on ATAPI devices
|
|
|
|
# SCSI Controllers
|
|
device ahb # EISA AHA1742 family
|
|
device ahc # AHA2940 and onboard AIC7xxx devices
|
|
device amd # AMD 53C974 (Teckram DC-390(T))
|
|
device dpt # DPT Smartcache - See LINT for options!
|
|
device isp # Qlogic family
|
|
device ncr # NCR/Symbios Logic
|
|
device sym # NCR/Symbios Logic (newer chipsets)
|
|
|
|
device adv0 at isa?
|
|
device adw
|
|
device bt0 at isa?
|
|
device aha0 at isa?
|
|
device aic0 at isa?
|
|
|
|
# SCSI peripherals
|
|
device scbus # SCSI bus (required)
|
|
device da # Direct Access (disks)
|
|
device sa # Sequential Access (tape etc)
|
|
device cd # CD
|
|
device pass # Passthrough device (direct SCSI access)
|
|
|
|
# RAID controllers
|
|
device amr # AMI MegaRAID
|
|
device mlx # Mylex DAC960 family
|
|
|
|
# atkbdc0 controls both the keyboard and the PS/2 mouse
|
|
device atkbdc0 at isa? port IO_KBD
|
|
device atkbd0 at atkbdc? irq 1
|
|
device psm0 at atkbdc? irq 12
|
|
|
|
device vga0 at isa? conflicts
|
|
|
|
# splash screen/screen saver
|
|
pseudo-device splash
|
|
|
|
# syscons is the default console driver, resembling an SCO console
|
|
device sc0 at isa?
|
|
|
|
# Enable this and PCVT_FREEBSD for pcvt vt220 compatible console driver
|
|
#device vt0 at isa?
|
|
#options XSERVER # support for X server
|
|
#options FAT_CURSOR # start with block cursor
|
|
# If you have a ThinkPAD, uncomment this along with the rest of the PCVT lines
|
|
#options PCVT_SCANSET=2 # IBM keyboards are non-std
|
|
|
|
# Floating point support - do not disable.
|
|
device npx0 at nexus? port IO_NPX irq 13
|
|
|
|
# Power management support (see LINT for more options)
|
|
device apm0 at nexus? disable flags 0x20 # Advanced Power Management
|
|
|
|
# PCCARD (PCMCIA) support
|
|
device card
|
|
device pcic0 at isa? irq 10 port 0x3e0 iomem 0xd0000
|
|
device pcic1 at isa? irq 11 port 0x3e2 iomem 0xd4000 disable
|
|
|
|
# Serial (COM) ports
|
|
device sio0 at isa? port IO_COM1 flags 0x10 irq 4
|
|
device sio1 at isa? port IO_COM2 irq 3
|
|
device sio2 at isa? disable port IO_COM3 irq 5
|
|
device sio3 at isa? disable port IO_COM4 irq 9
|
|
|
|
# Parallel port
|
|
device ppc0 at isa? irq 7
|
|
device ppbus # Parallel port bus (required)
|
|
device lpt # Printer
|
|
device plip # TCP/IP over parallel
|
|
device ppi # Parallel port interface device
|
|
#device vpo # Requires scbus and da
|
|
|
|
|
|
# PCI Ethernet NICs.
|
|
device de # DEC/Intel DC21x4x (``Tulip'')
|
|
device fxp # Intel EtherExpress PRO/100B (82557, 82558)
|
|
device tx # SMC 9432TX (83c170 ``EPIC'')
|
|
device vx # 3Com 3c590, 3c595 (``Vortex'')
|
|
device wx # Intel Gigabit Ethernet Card (``Wiseman'')
|
|
|
|
# PCI Ethernet NICs that use the common MII bus controller code.
|
|
device miibus # MII bus support
|
|
device dc # DEC/Intel 21143 and various workalikes
|
|
device rl # RealTek 8129/8139
|
|
device sf # Adaptec AIC-6915 (``Starfire'')
|
|
device sis # Silicon Integrated Systems SiS 900/SiS 7016
|
|
device ste # Sundance ST201 (D-Link DFE-550TX)
|
|
device tl # Texas Instruments ThunderLAN
|
|
device vr # VIA Rhine, Rhine II
|
|
device wb # Winbond W89C840F
|
|
device xl # 3Com 3c90x (``Boomerang'', ``Cyclone'')
|
|
|
|
# ISA Ethernet NICs.
|
|
device ed0 at isa? port 0x280 irq 10 iomem 0xd8000
|
|
device ex
|
|
device ep
|
|
# WaveLAN/IEEE 802.11 wireless NICs. Note: the WaveLAN/IEEE really
|
|
# exists only as a PCMCIA device, so there is no ISA attatement needed
|
|
# and resources will always be dynamically assigned by the pccard code.
|
|
device wi
|
|
# Aironet 4500/4800 802.11 wireless NICs. Note: the declaration below will
|
|
# work for PCMCIA and PCI cards, as well as ISA cards set to ISA PnP
|
|
# mode (the factory default). If you set the switches on your ISA
|
|
# card for a manually chosen I/O address and IRQ, you must specify
|
|
# those paremeters here.
|
|
device an
|
|
# The probe order of these is presently determined by i386/isa/isa_compat.c.
|
|
device ie0 at isa? port 0x300 irq 10 iomem 0xd0000
|
|
device fe0 at isa? port 0x300
|
|
device le0 at isa? port 0x300 irq 5 iomem 0xd0000
|
|
device lnc0 at isa? port 0x280 irq 10 drq 0
|
|
device cs0 at isa? port 0x300
|
|
device sn0 at isa? port 0x300 irq 10
|
|
# requires PCCARD (PCMCIA) support to be activated
|
|
#device xe0 at isa?
|
|
|
|
# Pseudo devices - the number indicates how many units to allocated.
|
|
pseudo-device loop # Network loopback
|
|
pseudo-device ether # Ethernet support
|
|
pseudo-device sl 1 # Kernel SLIP
|
|
pseudo-device ppp 1 # Kernel PPP
|
|
pseudo-device tun # Packet tunnel.
|
|
pseudo-device pty # Pseudo-ttys (telnet etc)
|
|
pseudo-device md # Memory "disks"
|
|
|
|
# The `bpf' pseudo-device enables the Berkeley Packet Filter.
|
|
# Be aware of the administrative consequences of enabling this!
|
|
pseudo-device bpf #Berkeley packet filter
|
|
|
|
# USB support
|
|
#device uhci # UHCI PCI->USB interface
|
|
#device ohci # OHCI PCI->USB interface
|
|
#device usb # USB Bus (required)
|
|
#device ugen # Generic
|
|
#device uhid # "Human Interface Devices"
|
|
#device ukbd # Keyboard
|
|
#device ulpt # Printer
|
|
#device umass # Disks/Mass storage - Requires scbus and da0
|
|
#device ums # Mouse
|
|
# USB Ethernet
|
|
#device aue # ADMtek USB ethernet
|
|
#device cue # CATC USB ethernet
|
|
#device kue # Kawasaki LSI USB ethernet
|