lkml.org 
[lkml]   [2004]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    Subjectip contrack problem, not strictly followed RFC, DoS very much possible
    Hi list

    There is little bug, eversince, no author would agree to correct it
    (dunno why) in ip_conntrack_proto_tcp.c:91:
    unsigned long ip_ct_tcp_timeout_established = 5 DAYS;

    Making it 5 days, makes linux router vournable to (D)DoS attacks. You
    can fill out conntrack hash tables very quickly, making it virtually
    dead. This computer will only respond to direct action, from keyboard,
    com port. This is insane, it just blocks it self, and does nothing, no
    fallback scenario, nothing.
    As far as I remember ( I have to look and find exact place where it's
    writen ), RFC specifies this timeout as max 100s. 5 days is insane, and
    no argumentation will explain it. I would suggest changing it to 100
    SECS and remove line:
    #define DAYS * 24 HOURS

    as it won't be used anymore.

    If someone has argumentation for 5 days timeout, please speak out. In
    everyday life, router, desktop, server usage 100s is enough there, and
    makes my life easier, as many other linux admins.

    Thanks.

    --
    GJ
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:08    [W:5.193 / U:0.284 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site