lkml.org 
[lkml]   [1999]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectLinux Kernel Additions/Mods/Suggestions
Date
I have a firewalling suggestion:

It would be wise to make it so that when a TCO connection is being
refused, the administrator could control whether or not the refusal is
graceful or not; ie, no reset TCP packet is sent so that the initiating side
so that it cannot tell whether or not there is a host. Seeing how that you
can sysctl whether or not the kernel does ICMP echo responses; this would be
the next logical step for those who want to be a little more private on the
internet. I know the firewalling code already has support for TCP syn
detection, but there is, currently, no way to make it pay attention to which
ports are being listented on. The more appropiate thing to do is to have a
new firewalling rule that matches when the destination TCP port is or is not
being listened to.

For now however, I have created this patch which has a new sysctl file:
/proc/sys/net/ipv4/tcp_drop_syn_resets
which will control this behavior.

I have included a diff file....



[unhandled content-type:application/x-gzip]
\
 
 \ /
  Last update: 2005-03-22 13:52    [W:0.021 / U:0.372 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site