lkml.org 
[lkml]   [2000]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Fw: Local Denial-of-Service attack against Linux
"David S. Miller" wrote:
>
> Date: Sun, 26 Mar 2000 12:40:08 +0200
> From: Manfred Spraul <manfreds@colorfullife.com>
>
> Doesn't restore the original send buffer, it doubles the send buffer
> size.
>
> You are assuming that sysctl values and socket option settings
> are equivalent, they are not.
>
> We double on setsockopt SNDBUF to be more compatible about the
> meaning of the send buffer size with other systems. Most systems
> take it to mean the amount of data bytes that can be sent into
> the socket at one time, to be more immune to massive memory usage
> attacks we handle things differently.
>

This explains why setsockopt(SNDBUF) sets sk->sndbuf to twice the user
supplied number.

But IMHO
* getsockopt(SNDBUF) should return 1/2 sk->sndbuf.
* sk->sndbuf should be initialized to 2*wmem_default.


> When we allocate packet buffers, we act as if we are eating into twice
> the amount of sk->sndbuf bytes as the data length. This is to account
> for the extra overheads assosciated with the packet buffer struct and
> protocol header bytes. For example, when the user sends 1 byte of
> data over a socket, he is actually using a lot more memory than that
> (1 data byte + sizeof(protocol headers) + sizeof(struct sk_buff)).
>

Yes.
I overlooked that when I updated the message queue code: you could kill
the computer by sending lots of 0-byte messages to a SysV message queue
:-/

--
Manfred

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.053 / U:0.172 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site