Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1231546 > unrolled thread
| Started by | Matteo Croce <matteo@openwrt.org> |
|---|---|
| First post | 2015-09-23 18:40 +0200 |
| Last post | 2015-09-23 20:20 +0200 |
| Articles | 4 — 3 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [PATCH v4] add stealth mode Matteo Croce <matteo@openwrt.org> - 2015-09-23 18:40 +0200
Re: [PATCH v4] add stealth mode Eric Dumazet <eric.dumazet@gmail.com> - 2015-09-23 19:30 +0200
Re: [PATCH v4] add stealth mode David Miller <davem@davemloft.net> - 2015-09-23 20:20 +0200
Re: [PATCH v4] add stealth mode David Miller <davem@davemloft.net> - 2015-09-23 20:20 +0200
| From | Matteo Croce <matteo@openwrt.org> |
|---|---|
| Date | 2015-09-23 18:40 +0200 |
| Subject | Re: [PATCH v4] add stealth mode |
| Message-ID | <qbVfj-1fg-1@gated-at.bofh.it> |
2015-09-16 13:06 GMT+02:00 Florian Westphal <fw@strlen.de>:
>
> Matteo Croce <matteo@openwrt.org> wrote:
> > Add option to disable any reply not related to a listening socket,
> > like RST/ACK for TCP and ICMP Port-Unreachable for UDP.
> > Also disables ICMP replies to echo request and timestamp.
> > The stealth mode can be enabled selectively for a single interface.
>
> I think it would make more sense to extend the socket match
> in xtables if it can't be used to achive this already.
>
> seems like
> *filter
> :INPUT ACCEPT [0:0]
> -A INPUT -p tcp -m socket --nowildcard -j ACCEPT
> -A INPUT -p tcp -j DROP
> COMMIT
>
> Already does what you want for tcp, udp should work too.
> I'd much rather see xtables and/or nftables to be extended
> with whatever feature(s) are needed to configure such a policy
> rather than pushing this into the core network stack.
The point is to do the filtering without *tables at all,
like /proc/sys/net/ipv4/icmp_echo_ignore_all does for pings
--
Matteo Croce
OpenWrt Developer
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
CHAOS CALMER
-----------------------------------------------------
* 1 1/2 oz Gin Shake with a glassful
* 1/4 oz Triple Sec of broken ice and pour
* 3/4 oz Lime Juice unstrained into a goblet.
* 1 1/2 oz Orange Juice
* 1 tsp. Grenadine Syrup
-----------------------------------------------------
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Eric Dumazet <eric.dumazet@gmail.com> |
|---|---|
| Date | 2015-09-23 19:30 +0200 |
| Message-ID | <qbW1J-2ph-23@gated-at.bofh.it> |
| In reply to | #1231546 |
On Wed, 2015-09-23 at 18:36 +0200, Matteo Croce wrote: > 2015-09-16 13:06 GMT+02:00 Florian Westphal <fw@strlen.de>: > > > > Matteo Croce <matteo@openwrt.org> wrote: > > > Add option to disable any reply not related to a listening socket, > > > like RST/ACK for TCP and ICMP Port-Unreachable for UDP. > > > Also disables ICMP replies to echo request and timestamp. > > > The stealth mode can be enabled selectively for a single interface. > > > > I think it would make more sense to extend the socket match > > in xtables if it can't be used to achive this already. > > > > seems like > > *filter > > :INPUT ACCEPT [0:0] > > -A INPUT -p tcp -m socket --nowildcard -j ACCEPT > > -A INPUT -p tcp -j DROP > > COMMIT > > > > Already does what you want for tcp, udp should work too. > > I'd much rather see xtables and/or nftables to be extended > > with whatever feature(s) are needed to configure such a policy > > rather than pushing this into the core network stack. > > The point is to do the filtering without *tables at all, > like /proc/sys/net/ipv4/icmp_echo_ignore_all does for pings Yes, but this adds code in many places, even for people not caring of such protection. The point is : people wanting firewall like protections should instead use netfilter framework. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | David Miller <davem@davemloft.net> |
|---|---|
| Date | 2015-09-23 20:20 +0200 |
| Message-ID | <qbWO6-3Bx-3@gated-at.bofh.it> |
| In reply to | #1231587 |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Wed, 23 Sep 2015 10:29:52 -0700 > Yes, but this adds code in many places, even for people not caring of > such protection. > > The point is : people wanting firewall like protections should instead > use netfilter framework. +1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | David Miller <davem@davemloft.net> |
|---|---|
| Date | 2015-09-23 20:20 +0200 |
| Message-ID | <qbWO6-3Bx-5@gated-at.bofh.it> |
| In reply to | #1231546 |
From: Matteo Croce <matteo@openwrt.org> Date: Wed, 23 Sep 2015 18:36:12 +0200 > The point is to do the filtering without *tables at all, > like /proc/sys/net/ipv4/icmp_echo_ignore_all does for pings That's not a good argument, sorry. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web