Ports

[noct]

Is grsecurity in anyway capable of blocking ports on both IPv4 and IPv6 addresses in an iptables fashion?

[Technion]

As you said, iptables does this. So why would anybody else reimplement packet filtering, given the amount of work the netfilter team has put into iptables?

[noct]

Because iptables requires an extensive amount of research, time, and learning to get it to work properly whereas grsecurity is made fairly easy to work with, and it was just a question.

[spender]

My goal in writing the IP ACLs for grsecurity was to do the things iptables can't, which was handling important syscalls related to networking, so that their error conditions could be returned to the application. So I decided to implement for socket, connect, and bind, also because the kind of checks that we have to do can't really be done in a fast way (or at least I have no idea how to do them in an efficient way other than traversing the list), and these syscalls aren't a bottleneck on a system.

-Brad

[noct]

Sounds good.