Messages in this thread | | | Date | Mon, 13 Jun 2005 08:17:48 +0200 | From | Willy Tarreau <> | Subject | Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.) |
| |
On Mon, Jun 13, 2005 at 03:24:04PM +1000, Herbert Xu wrote: > On Mon, Jun 13, 2005 at 07:21:48AM +0200, Willy Tarreau wrote: > > > > > A much better place to do that is netfilter. If you do it there > > > then not only will your protect all Linux machines from this attack, > > > but you'll also protect all the other BSD-derived TCP stacks. > > > > Netfilter already blocks simultaneous connection. A SYN in return to > > a SYN produces an INVALID state. > > Any reason why that isn't enough?
I don't think there are a lot of people who load ip_conntrack and insert a single DROP rule on their servers just to workaround weaknesses in the TCP stack. If they did, they would not be more confident into netfilter either because it would be logical to expect the same reasoning (eg: let's not fix XX here, TCP will catch it).
What's the problem with the sysctl ? If you prefer, I can change the patch to keep the feature enabled by default so that only people aware of the problem have to fix it by hand. But I found it better the other way : people who need the feature enable it by hand.
Cheers, willy
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |