Page MenuHomeFreeBSD
Files F111366217

D3528.id8519.diff
No OneTemporary
Actions

D3528.id8519.diff
View Options

Index: share/man/man4/blackhole.4
===================================================================
--- share/man/man4/blackhole.4
+++ share/man/man4/blackhole.4
@@ -12,7 +12,7 @@
.\"
.\"
.\" $FreeBSD$
-.Dd January 1, 2007
+.Dd September 6, 2015
.Dt BLACKHOLE 4
.Os
.Sh NAME
@@ -19,18 +19,31 @@
.Nm blackhole
.Nd a
.Xr sysctl 8
-MIB for manipulating behaviour in respect of refused TCP or UDP connection
+MIB for manipulating behaviour in respect of refused SCTP, TCP, or UDP connection
attempts
.Sh SYNOPSIS
-.Cd sysctl net.inet.tcp.blackhole[=[0 | 1 | 2]]
-.Cd sysctl net.inet.udp.blackhole[=[0 | 1]]
+.Cd sysctl net.inet.sctp.blackhole Ns Op = Ns Brq "0 | 1"
+.Cd sysctl net.inet.tcp.blackhole Ns Op = Ns Brq "0 | 1 | 2"
+.Cd sysctl net.inet.udp.blackhole Ns Op = Ns Brq "0 | 1"
.Sh DESCRIPTION
The
.Nm
.Xr sysctl 8
MIB is used to control system behaviour when connection requests
-are received on TCP or UDP ports where there is no socket listening.
+are received on SCTP, TCP, or UDP ports where there is no socket listening.
.Pp
+The blackhole behaviour is useful to slow down anyone who is port scanning
+a system, attempting to detect vulnerable services on a system.
+It could potentially also slow down someone who is attempting a denial
+of service attack.
+.Ss SCTP
+Enabling blackhole behaviour turns off the sending of ABORT packets
+as follows:
+A MIB value of one will prevent sending an ABORT packet
+in response to an incoming INIT.
+A MIB value of two will do the same, but also prevent sending an ABORT packet
+when unexpected packets are received.
+.Ss TCP
Normal behaviour, when a TCP SYN segment is received on a port where
there is no socket accepting connections, is for the system to return
a RST segment, and drop the connection.
@@ -44,20 +57,15 @@
By setting the MIB value to two, any segment arriving
on a closed port is dropped without returning a RST.
This provides some degree of protection against stealth port scans.
-.Pp
-In the UDP instance, enabling blackhole behaviour turns off the sending
+.Ss UDP
+Enabling blackhole behaviour turns off the sending
of an ICMP port unreachable message in response to a UDP datagram which
arrives on a port where there is no socket listening.
It must be noted that this behaviour will prevent remote systems from running
.Xr traceroute 8
to a system.
-.Pp
-The blackhole behaviour is useful to slow down anyone who is port scanning
-a system, attempting to detect vulnerable services on a system.
-It could potentially also slow down someone who is attempting a denial
-of service attack.
.Sh WARNING
-The TCP and UDP blackhole features should not be regarded as a replacement
+The SCTP, TCP, and UDP blackhole features should not be regarded as a replacement
for firewall solutions.
Better security would consist of the
.Nm
@@ -68,6 +76,7 @@
It should be used together with other security mechanisms.
.Sh SEE ALSO
.Xr ip 4 ,
+.Xr sctp 4 ,
.Xr tcp 4 ,
.Xr udp 4 ,
.Xr ipf 8 ,
@@ -80,5 +89,10 @@
MIBs
first appeared in
.Fx 4.0 .
+.Pp
+The SCTP
+.Nm
+MIB first appeared in
+.Fx 9.1 .
.Sh AUTHORS
.An Geoffrey M. Rehmet
Index: sys/netinet/sctp_sysctl.h
===================================================================
--- sys/netinet/sctp_sysctl.h
+++ sys/netinet/sctp_sysctl.h
@@ -545,7 +545,7 @@
#define SCTPCTL_RTTVAR_DCCCECN_MAX 1
#define SCTPCTL_RTTVAR_DCCCECN_DEFAULT 1 /* 0 means disable feature */
-#define SCTPCTL_BLACKHOLE_DESC "Enable SCTP blackholing"
+#define SCTPCTL_BLACKHOLE_DESC "Enable SCTP blackholing. See blackhole(4) for more details."
#define SCTPCTL_BLACKHOLE_MIN 0
#define SCTPCTL_BLACKHOLE_MAX 2
#define SCTPCTL_BLACKHOLE_DEFAULT SCTPCTL_BLACKHOLE_MIN

File Metadata

Mime Type
text/plain
Expires
Mon, Mar 3, 9:56 PM (7 h, 7 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
16954443
Default Alt Text
D3528.id8519.diff (3 KB)

Event Timeline