Messages in this thread | | | Date | Sun, 26 Mar 2000 13:36:50 +0200 | From | Manfred Spraul <> | Subject | Re: Fw: Local Denial-of-Service attack against Linux |
| |
"David S. Miller" wrote: > > Date: Sun, 26 Mar 2000 12:40:08 +0200 > From: Manfred Spraul <manfreds@colorfullife.com> > > Doesn't restore the original send buffer, it doubles the send buffer > size. > > You are assuming that sysctl values and socket option settings > are equivalent, they are not. > > We double on setsockopt SNDBUF to be more compatible about the > meaning of the send buffer size with other systems. Most systems > take it to mean the amount of data bytes that can be sent into > the socket at one time, to be more immune to massive memory usage > attacks we handle things differently. >
This explains why setsockopt(SNDBUF) sets sk->sndbuf to twice the user supplied number.
But IMHO * getsockopt(SNDBUF) should return 1/2 sk->sndbuf. * sk->sndbuf should be initialized to 2*wmem_default.
> When we allocate packet buffers, we act as if we are eating into twice > the amount of sk->sndbuf bytes as the data length. This is to account > for the extra overheads assosciated with the packet buffer struct and > protocol header bytes. For example, when the user sends 1 byte of > data over a socket, he is actually using a lot more memory than that > (1 data byte + sizeof(protocol headers) + sizeof(struct sk_buff)). >
Yes. I overlooked that when I updated the message queue code: you could kill the computer by sending lots of 0-byte messages to a SysV message queue :-/
-- Manfred
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |