On Sun, Jun 12, 2005 at 04:24:01PM +0200, Willy Tarreau wrote: > > 1) no firewall in front of A > - C spoofs A and sends a fake SYN to B > - B responds to A with a SYN-ACK > - A sends an RST to B, which clears the session > - A wants to connect and sends its SYN to B which accepts it. Well the attacker simply has to keep sending the same SYN packet over and over again until A runs out of SYN retries. What I really don't like about your patch is the fact that it is trying to impose a policy decision (that of forbidding all simultaneous connection initiations) inside the TCP stack. A much better place to do that is netfilter. If you do it there then not only will your protect all Linux machines from this attack, but you'll also protect all the other BSD-derived TCP stacks. Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
- Follow-Ups:
- References:
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Herbert Xu <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- From: Willy Tarreau <[email protected]>
- Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- Prev by Date: [RT] Re: [PATCH] local_irq_disable removal
- Next by Date: Re: [PATCH] Dynamic tick for x86 version 050609-2
- Previous by thread: Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- Next by thread: Re: [PATCH] fix small DoS on connect() (was Re: BUG: Unusual TCP Connect() results.)
- Index(es):
 |