# SPDX-FileCopyrightText: 2026 Echolot contributors
# SPDX-License-Identifier: GPL-3.0-or-later
#
# Recommended sysctls for an Echolot probe-server host: keep the kernel from
# silently altering what clients measure. Install with:
#   sudo cp 99-echolot-sysctl.conf /etc/sysctl.d/
#   sudo sysctl --system
# The daemon audits these at startup and via GET /admin/selftest; anything not
# set here shows up as a "not measurement-clean" warning.

# Static-addressed host: never let a Router Advertisement mutate our routing.
# (Echolot's whole job is detecting broken RAs — the server must be immune.)
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0

# Don't let ICMP redirects rewrite our routing mid-measurement, and don't
# emit redirects (we're an endpoint, not a router).
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Don't throttle the server's own ICMP errors (dest-unreachable/frag-needed/
# time-exceeded) — throttling produces false loss/black-hole readings when
# clients probe toward this server.
net.ipv4.icmp_ratelimit = 0

# These are usually already correct; pinned so the server can honestly
# negotiate/reflect them (a missing option in a client's evidence is then the
# path's fault, not ours).
net.ipv4.tcp_sack = 1
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.icmp_echo_ignore_all = 0

# Loose reverse-path filtering suits a multi-IP measurement host (strict mode
# can drop alt-address / asymmetric replies used by STUN 5780).
net.ipv4.conf.all.rp_filter = 2