From: Daniel Borkmann <daniel@iogearbox•net>
To: Matteo Croce <matteo@openwrt•org>, David Miller <davem@davemloft•net>
Cc: netdev@vger•kernel.org, linux-kernel@vger•kernel.org
Subject: Re: [PATCH v4] add stealth mode
Date: Wed, 16 Sep 2015 12:26:57 +0200 [thread overview]
Message-ID: <55F943F1.4030903@iogearbox.net> (raw)
In-Reply-To: <1442397259-28894-1-git-send-email-matteo@openwrt.org>
On 09/16/2015 11:54 AM, Matteo Croce wrote:
> Add option to disable any reply not related to a listening socket,
> like RST/ACK for TCP and ICMP Port-Unreachable for UDP.
> Also disables ICMP replies to echo request and timestamp.
> The stealth mode can be enabled selectively for a single interface.
>
> Signed-off-by: Matteo Croce <matteo@openwrt•org>
> ---
> rebased on 4.3-rc1
>
> Documentation/networking/ip-sysctl.txt | 14 ++++++++++++++
> include/linux/inetdevice.h | 1 +
> include/linux/ipv6.h | 1 +
> include/uapi/linux/ip.h | 1 +
> net/ipv4/devinet.c | 1 +
> net/ipv4/icmp.c | 6 ++++++
> net/ipv4/ip_input.c | 5 +++--
> net/ipv4/tcp_ipv4.c | 3 ++-
> net/ipv4/udp.c | 4 +++-
> net/ipv6/addrconf.c | 7 +++++++
> net/ipv6/icmp.c | 3 ++-
> net/ipv6/ip6_input.c | 5 +++--
> net/ipv6/tcp_ipv6.c | 2 +-
> net/ipv6/udp.c | 3 ++-
> 14 files changed, 47 insertions(+), 9 deletions(-)
>
> diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
> index ebe94f2..1d46adc 100644
> --- a/Documentation/networking/ip-sysctl.txt
> +++ b/Documentation/networking/ip-sysctl.txt
> @@ -1206,6 +1206,13 @@ igmp_link_local_mcast_reports - BOOLEAN
> 224.0.0.X range.
> Default TRUE
>
> +stealth - BOOLEAN
> + Disable any reply not related to a listening socket,
> + like RST/ACK for TCP and ICMP Port-Unreachable for UDP.
> + Also disables ICMP replies to echo requests and timestamp
> + and ICMP errors for unknown protocols.
> + Default value is 0.
> +
Hmm, what about all other protocols besides TCP/UDP such as SCTP, DCCP,
etc? It seems it gives false expectations in such cases when the user
enables being "stealth", but finds out it has no effect at all there ...
nmap f.e. has a couple of scanning options for SCTP, and at least SCTP
is still relevant in telco space.
I know this question has been asked before, but the only answer on this
was so far: "well, I've never played with SCTP before" ... :/
next prev parent reply other threads:[~2015-09-16 10:26 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-02 8:47 [PATCH] [PATCH v3] add stealth mode Matteo Croce
2015-09-15 19:00 ` David Miller
2015-09-16 9:54 ` [PATCH v4] " Matteo Croce
2015-09-16 10:26 ` Daniel Borkmann [this message]
2015-09-16 10:45 ` Matteo Croce
2015-09-16 11:11 ` Daniel Borkmann
2015-09-16 11:06 ` Florian Westphal
2015-09-23 16:36 ` Matteo Croce
2015-09-23 17:29 ` Eric Dumazet
2015-09-23 18:16 ` David Miller
2015-09-23 18:15 ` David Miller
2015-09-16 11:11 ` Eric Dumazet
2015-09-23 16:32 ` Matteo Croce
2015-09-23 18:15 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55F943F1.4030903@iogearbox.net \
--to=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=matteo@openwrt$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox