For anyone that doesn't know, this reads the header and drops the packet if the length isn't 5*4 bytes, meaning it includes options.
Why tf do we have options in the header at all if you ca drop everything that does, be secure and everything still works?
Why the actual F%$K haven't they been deprecated and packets using them dropped by literally every tcp/ip stack if their only function is to get you f%$king pwned?
That might be a very dumb question for all I know. Maybe i shouldn't be cranky. It all seems like there are some very blase attitudes to this kind of thing, that should not even exist anymore, creating massive security holes, with zero upside tradeoff.
The seeming asymmetry offends me.
On the one hand it increases the attack surface and so the security risk. On the other, nothing. Yeah, let's take /that/ tradeoff on behalf of the entire internet.
So I'm so stupid & ignorant of security I think I would define "Internet tcp/ip" which conformant stacks block this rubbish by default like they do any other non-conforming packet. Thus reducing the attack surface essentially with no tradeoff. Weird uses can use customised lwip or whatever for these uses where we don't know the who, the what or the why (or perhaps even the IF).
Seems like nobody is shipping these firewall rules by default on internet routers. We get the vulnerability and as a tradeoff we get nothing of any value to us. Who do we thank for that?
What is the rationale, the justification for not paring away the garbage that does nothing but create vulnerabilities?
Obvious and sensible engineering at a protocol level seems very worthwhile to me.