Subject: Re: [PATCH] TCP: add option for silent port knocking with integrity protection

From: Andi Kleen <[email-masked]>
Date: Wed, 11 Dec 2013 13:25:22 -0800

Stephen Hemminger <[email-masked]> writes:
>
> The point is that doing it outside of TCP core is safer, less error prone
> and more flexible.

Or to put the question differently: what hooks would be needed to make
this efficiently work in user space?

It could be something like this: Firewall the port with forwarding the 
SYN packets using nfqueue, check for the SYN having the right magic,
change a firewall rule, re-inject using nfqueue (not fully sure how
well that works)

-Andi

-- 
[email-masked] -- Speaking for myself only