Messages in this thread | | | From | "Arch" <> | Subject | Linux Kernel Additions/Mods/Suggestions | Date | Wed, 7 Jul 1999 20:21:14 -0700 |
| |
I have a firewalling suggestion:
It would be wise to make it so that when a TCO connection is being refused, the administrator could control whether or not the refusal is graceful or not; ie, no reset TCP packet is sent so that the initiating side so that it cannot tell whether or not there is a host. Seeing how that you can sysctl whether or not the kernel does ICMP echo responses; this would be the next logical step for those who want to be a little more private on the internet. I know the firewalling code already has support for TCP syn detection, but there is, currently, no way to make it pay attention to which ports are being listented on. The more appropiate thing to do is to have a new firewalling rule that matches when the destination TCP port is or is not being listened to.
For now however, I have created this patch which has a new sysctl file: /proc/sys/net/ipv4/tcp_drop_syn_resets which will control this behavior.
I have included a diff file....
[unhandled content-type:application/x-gzip] | |