diff options
| author | csgr <csgr@FreeBSD.org> | 1999-08-17 12:17:53 +0000 |
|---|---|---|
| committer | csgr <csgr@FreeBSD.org> | 1999-08-17 12:17:53 +0000 |
| commit | 83e27dbadf6d54c9da1816d9e50aa2e0c77cfa3b (patch) | |
| tree | b282b74566f8902c296b6e7653f92505d2358c3f /sys/netinet/tcp_input.c | |
| parent | cf21d97ccd6296e40a082b743e278c15c6174ed9 (diff) | |
| download | FreeBSD-src-83e27dbadf6d54c9da1816d9e50aa2e0c77cfa3b.zip FreeBSD-src-83e27dbadf6d54c9da1816d9e50aa2e0c77cfa3b.tar.gz | |
Add net.inet.tcp.blackhole and net.inet.udp.blackhole
sysctl knobs.
With these knobs on, refused connection attempts are dropped
without sending a RST, or Port unreachable in the UDP case.
In the TCP case, sending of RST is inhibited iff the incoming
segment was a SYN.
Docs and rc.conf settings to follow.
Diffstat (limited to 'sys/netinet/tcp_input.c')
| -rw-r--r-- | sys/netinet/tcp_input.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 0e3ffb8..1e86379 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 - * $Id: tcp_input.c,v 1.86 1999/05/06 18:13:01 peter Exp $ + * $Id: tcp_input.c,v 1.87 1999/07/18 14:42:48 jmb Exp $ */ #include "opt_ipfw.h" /* for ipfw_fwd */ @@ -84,6 +84,10 @@ static int log_in_vain = 0; SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW, &log_in_vain, 0, "Log all incoming TCP connections"); +static int blackhole = 0; +SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW, + &blackhole, 0, "Do not send RST when dropping refused connections"); + int tcp_delack_enabled = 1; SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW, &tcp_delack_enabled, 0, @@ -404,7 +408,10 @@ findpcb: if (badport_bandlim(1) < 0) goto drop; #endif - goto dropwithreset; + if(blackhole && tiflags & TH_SYN) + goto drop; + else + goto dropwithreset; } tp = intotcpcb(inp); if (tp == 0) |
