linux-kernel - Re: [PATCH 1/2] xt_connlimit (kernel)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.61.0706031914120.10578@yvahk01.tjqt.qr>
Date:	Sun, 3 Jun 2007 19:18:48 +0200 (MEST)
From:	Jan Engelhardt <jengelh@...ux01.gwdg.de>
To:	Andrew Beverley <andy@...ybev.com>
cc:	Netfilter Developer Mailing List 
	<netfilter-devel@...ts.netfilter.org>,
	Netfilter Mailing List <netfilter@...ts.netfilter.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/2] xt_connlimit (kernel) - connection limiting

On Jun 3 2007 18:00, Andrew Beverley wrote:
>On Sun, 2007-06-03 at 13:12 +0200, Jan Engelhardt wrote:
>> Adds the connlimit match that has been in POM-NG for a long time.
>> 
>>     *	works with 2.6.22, xtables'ified and all that
>> 
>>     *	will request nf_conntrack_ipv4 upon load
>> 	(otherwise it hotdrops every packet - a glitch that goes back
>> 	to at least 2.6.20.2)
>
>Excellent! This has been at the back of my mind for a while.
>
>Is there any chance of getting UDP flows added as well as TCP
>connections?

I dare to say it's easy. The real problem is rather, that UDP is
connectionless, so for one, connlimit can, by definition of the word
'connectionless', not apply to UDP, though it is technically
possible. Second, because UDP "connections" "fly" (timeout after 30
seconds), just spewing one UDP packet out may kill another connection
(e.g. if you use connlimit in conjunction with DROP or REJECT).
What's more, UDP packets can be easily forged, much more than TCP, so
anyone on the same subtree (not subnet, because that's something
different) can send a bogus UDP packet and stop your connections from
working.
Let's see how to implement UDP counting...

	Jan
-- 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/