netdev - Re: [PATCH 2/2] tuntap: limit the number of flow caches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20130123.135024.1407137924304146015.davem@davemloft.net>
Date:	Wed, 23 Jan 2013 13:50:24 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	jasowang@...hat.com
Cc:	mst@...hat.com, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, stephen@...workplumber.org
Subject: Re: [PATCH 2/2] tuntap: limit the number of flow caches

From: Jason Wang <jasowang@...hat.com>
Date: Wed, 23 Jan 2013 21:59:13 +0800

> We create new flow caches when a new flow is identified by tuntap, This may lead
> some issues:
> 
> - userspace may produce a huge amount of short live flows to exhaust host memory
> - the unlimited number of flow caches may produce a long list which increase the
>   time in the linear searching
> 
> Solve this by introducing a limit of total number of flow caches.
> 
> Cc: Stephen Hemminger <stephen@...workplumber.org>
> Signed-off-by: Jason Wang <jasowang@...hat.com>
> ---

Applied, but really flow caches are an extremely broken concept especially
when external entities control the population of such caches.

We removed the routing cache of the ipv4 networking code exactly because
this kind of crap does not work at all.

Next you're going to have to add a delicately managed garbage
collection scheme for this tuntap flow cache, and that will be tuned
endlessly, when the real issue is that fundamentally this does not
work.

Instead, make the full lookup scale properly and use appropriate data
structures.  It won't be as fast as a simple hash table demux, but
it'll actually be immune to growth issues and DoS attacks and give
consistent and repeatable lookup performance regardless of traffic
patterns.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html