OpenBSD's tcpdrop(8)
Maxim Konovalov
maxim at macomnet.ru
Mon Feb 21 20:48:58 GMT 2005
George,
On Tue, 22 Feb 2005, 00:34+0900, gnn at freebsd.org wrote:
> At Sun, 23 Jan 2005 20:05:26 +0300 (MSK),
> Maxim Konovalov wrote:
> >
> > Hello,
> >
> > I've ported OpenBSD's tcpdrop(8) and a relevant kernel part.
> > >From the man page, http://tinyurl.com/4lvo9
> >
> > The tcpdrop command drops the TCP connection specified by the local
> > address laddr, port lport and the foreign address faddr, port fport.
> >
> > There are patches for HEAD and RELENG_4:
> >
> > http://people.freebsd.org/~maxim/diff/tcpdrop.diff
> > http://people.freebsd.org/~maxim/diff/tcpdrop.diff-4
> >
> > Two questions: do we want to have it in the base system? Does the
> > diff look OK (I didn't test IPv6 part)?
>
> Hi Maxim,
>
> I finally got around to testing this on IPv6. It was not an
> exhaustive test but I used NetPIPE to run a client and server over
> localhost (::1) for IPv6 and then forced a drop. The machine is a
> PIII SMP box (elephant if you know the test lab stuff). No problems
> encountered, and I can only do the drop as root, which is what I would
> hope and expect.
Thank you very much for testing! A version with the correct locking
(rwatson@) and improved IPv6 (ume@) is already in the tree.
> A very cool feature. I vote for it being in the base system. Are
> there jail issues? I haven't thought that aspect of the security of
> this feature through yet.
We do not allow to modify sysctls in jail by default (!CTLFLAG_PRISON
case) so I think net.inet.tcp.drop is jail-safe. And it does not
allow to discover an existent (or non-existent) tcp connection in the
host system from the jail.
--
Maxim Konovalov
More information about the freebsd-current
mailing list