| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 27 Jun 2012 15:34:54 -0700 (PDT) From: David Miller <davem@...emloft.net> To: eric.dumazet@...il.com Cc: netdev@...r.kernel.org, hans.schillstrom@...csson.com Subject: Re: [PATCH net-next] ipv4: tcp: dont cache unconfirmed intput dst From: Eric Dumazet <eric.dumazet@...il.com> Date: Wed, 27 Jun 2012 11:14:15 +0200 > From: Eric Dumazet <edumazet@...gle.com> > > DDOS synflood attacks hit badly IP route cache. > > On typical machines, this cache is allowed to hold up to 8 Millions dst > entries, 256 bytes for each, for a total of 2GB of memory. > > rt_garbage_collect() triggers and tries to cleanup things. > > Eventually route cache is disabled but machine is under fire and might > OOM and crash. > > This patch exploits the new TCP early demux, to set a nocache > boolean in case incoming TCP frame is for a not yet ESTABLISHED or > TIMEWAIT socket. > > This 'nocache' boolean is then used in case dst entry is not found in > route cache, to create an unhashed dst entry (DST_NOCACHE) > > SYN-cookie-ACK sent use a similar mechanism (ipv4: tcp: dont cache > output dst for syncookies), so after this patch, a machine is able to > absorb a DDOS synflood attack without polluting its IP route cache. > > Signed-off-by: Eric Dumazet <edumazet@...gle.com> Applied, thanks Eric. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists