netdev - Re: IPv4 route cache DOS attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 27 Nov 2012 17:01:14 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	叶雨飞 <sunyucong@...il.com>
Cc:	netdev <netdev@...r.kernel.org>
Subject: Re: IPv4 route cache DOS attack

On Tue, 2012-11-27 at 15:15 -0800, 叶雨飞 wrote:
> Hi,
> 
> I have a linux router running kernel 3.2  that receive public ingress
> packets and route them through an GRE tunnel, return packets don't go
> through it
> 
> I've recently faced a serious issue with the route cache,  when the
> router received spoofed source , the route cache will quickly get
> exhausted (depending on the size of it) and soon the ip dst cache
> overflow will be printed and network subsystem will hang until
> restarted.
> 
> So, my question is, how can I turn off the route cache without
> recompile the kernel or adding the  patch for removal  in 3.7?  I
> tried to set
> 
> echo 0 > /proc/sys/net/ipv4/route/max_size but that has no effect at all.
> 
> And if some one can share some insight on why when dst cache
> overflows, the network subsystem hangs, it would be great.

echo -1 >/proc/sys/net/ipv4/rt_cache_rebuild_count



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html