lkml.org 
[lkml]   [2015]   [Sep]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v4] add stealth mode
    On 09/16/2015 11:54 AM, Matteo Croce wrote:
    > Add option to disable any reply not related to a listening socket,
    > like RST/ACK for TCP and ICMP Port-Unreachable for UDP.
    > Also disables ICMP replies to echo request and timestamp.
    > The stealth mode can be enabled selectively for a single interface.
    >
    > Signed-off-by: Matteo Croce <matteo@openwrt.org>
    > ---
    > rebased on 4.3-rc1
    >
    > Documentation/networking/ip-sysctl.txt | 14 ++++++++++++++
    > include/linux/inetdevice.h | 1 +
    > include/linux/ipv6.h | 1 +
    > include/uapi/linux/ip.h | 1 +
    > net/ipv4/devinet.c | 1 +
    > net/ipv4/icmp.c | 6 ++++++
    > net/ipv4/ip_input.c | 5 +++--
    > net/ipv4/tcp_ipv4.c | 3 ++-
    > net/ipv4/udp.c | 4 +++-
    > net/ipv6/addrconf.c | 7 +++++++
    > net/ipv6/icmp.c | 3 ++-
    > net/ipv6/ip6_input.c | 5 +++--
    > net/ipv6/tcp_ipv6.c | 2 +-
    > net/ipv6/udp.c | 3 ++-
    > 14 files changed, 47 insertions(+), 9 deletions(-)
    >
    > diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
    > index ebe94f2..1d46adc 100644
    > --- a/Documentation/networking/ip-sysctl.txt
    > +++ b/Documentation/networking/ip-sysctl.txt
    > @@ -1206,6 +1206,13 @@ igmp_link_local_mcast_reports - BOOLEAN
    > 224.0.0.X range.
    > Default TRUE
    >
    > +stealth - BOOLEAN
    > + Disable any reply not related to a listening socket,
    > + like RST/ACK for TCP and ICMP Port-Unreachable for UDP.
    > + Also disables ICMP replies to echo requests and timestamp
    > + and ICMP errors for unknown protocols.
    > + Default value is 0.
    > +

    Hmm, what about all other protocols besides TCP/UDP such as SCTP, DCCP,
    etc? It seems it gives false expectations in such cases when the user
    enables being "stealth", but finds out it has no effect at all there ...
    nmap f.e. has a couple of scanning options for SCTP, and at least SCTP
    is still relevant in telco space.

    I know this question has been asked before, but the only answer on this
    was so far: "well, I've never played with SCTP before" ... :/


    \
     
     \ /
      Last update: 2015-09-16 13:01    [W:4.159 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site