The patch below is an RFC only.  It implements "blackhole"
interface option for IPv4 (for now) TCP and UDP protocols,
adding a boolean "blackhole" in /proc/sys/net/ipv4/conf/*/
(per-interface).  The intent is to be able to ignore common
"invalid" IP traffic on (usually high-loaded) internet
servers, to stop such machines to participate in several
kinds of [D]DoS attacks and to reduce the load and bandwidth
utilisation.

Before someone asks: no, this feature isn't easily doable
using iptables, because of the following reasons:

 o iptables are somewhat heavy-weight esp for high-traffic sites

 o it is not possible to allow outgoing connections to pass
   with iptables, without ip_conntrack module

 o ip_conntrack has alot of its own limitations, again esp.
   for high-traffic sites

The patch below adds a simple check into the non-speed-critical
path, when, after realizing the destination port isn't listening,
ICMP port unreach (for UDP) or RST (for TCP) packet is generated.

This feature is similar to the one found on eg FreeBSD, with several
differences:

 o FreeBSD have global flags, while this patch implements the
   feature per-interface

 o FreeBSD uses two different flags for TCP and UDP, and distinguishes
   between TCP SYN packets (initial TCP handshake) and the rest,
   while this patch has one boolean (per interface) for both
   UDP and TCP.

There's an implementation question I have unanswered, too.  When,
having an skb pointer, we're checking if a corresponding (input)
interface has 'blackhole' option set, we should reference
skb->input_dev.  All accesses to this variable are done with a
lock set, using in_dev_get().  In this patch, I used lockless
__in_dev_get() variant, which does not seem to be right..  Is
it the only way here to use in_dev_get() and in_dev_put()?

Thanks.

/mjt