From 11bb2b9004d506e1337eb191b4983acd700e65d9 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Thu, 13 Aug 2015 17:17:25 +0200
Subject: [PATCH] system: add defaults for newer sysctls

---
 src/etc/config.xml.sample | 13 +++----------
 src/etc/inc/system.inc    |  4 ++++
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/src/etc/config.xml.sample b/src/etc/config.xml.sample
index 365df90b8..23389535e 100644
--- a/src/etc/config.xml.sample
+++ b/src/etc/config.xml.sample
@@ -55,16 +55,9 @@
 		</item>
 		<item>
 			<descr><![CDATA[
-				Redirect attacks are the purposeful mass issuing of ICMP type 5 packets. In a normal network, redirects
-				to the end stations should not be required. To defend against this type of attack both the sending and
-				accepting of redirect should be disabled.
-			]]></descr>
-			<tunable>net.inet.icmp.redirect</tunable>
-			<value>default</value>
-		</item>
-		<item>
-			<descr><![CDATA[
-				This option enables the NIC to drop all inbound ICMP redirect packets without returning a response.
+				Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects
+				to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect
+				packets without returning a response.
 			]]></descr>
 			<tunable>net.inet.icmp.drop_redirect</tunable>
 			<value>default</value>
diff --git a/src/etc/inc/system.inc b/src/etc/inc/system.inc
index 650399d86..631b91015 100644
--- a/src/etc/inc/system.inc
+++ b/src/etc/inc/system.inc
@@ -78,6 +78,10 @@ function get_default_sysctl_value($id)
 		"net.inet.tcp.recvspace" => "65228",
 		"net.inet.tcp.sendspace" => "65228",
 		"net.inet.ip.fastforwarding" => "0",
+		'net.inet.ip.sourceroute' => '0',
+		'net.inet.ip.accept_sourceroute' => '0',
+		'net.inet.icmp.drop_redirect' => '0',
+		'net.inet.icmp.log_redirect' => '0',
 		"net.inet.tcp.delayed_ack" => "0",
 		"net.inet.udp.maxdgram" => "57344",
 		"net.inet.ip.intr_queue_maxlen" => "1000",