lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 30 Jun 2014 20:15:18 +0200
From:	Jesper Dangaard Brouer <>
To: (Eric W. Biederman)
Cc:, Cong Wang <>,
	David Miller <>,
	Linux Kernel Network Developers <>,
	Patrick McHardy <>,
	Stephen Hemminger <>,
	Cong Wang <>,
	Stefan Bader <>,,,
	Serge Hallyn <>,
	Hannes Frederic Sowa <>
Subject: Re: [Patch net-next] net: make neigh tables per netns

On Fri, 27 Jun 2014 22:12:52 -0700 (Eric W. Biederman) wrote:
> Cong Wang <> writes:
> > On Thu, Jun 26, 2014 at 3:44 PM, David Miller <> wrote:
> >>
> >
> > Hmm, I did overlook the potential DOS problem. But hold on, isn't
> > IP fragments have the same problem? The fragment queues are per
> > netns, and the thresh is per netns as well, we will eventually have
> > memory pressure as well.
> Interesting.  It does look like ip fragments are susceptible that way.

For IP fragments we have per netns mem-limit and LRU-list, but all
netns share the same hash table, which have its own DoS potential.

And argh! - we have a hardcoded INETFRAGS_MAXDEPTH=128, which can be
used for (slow) DoS of IP frags if enough netns are created.

Introduced by commit 5a3da1fe9 ("inet: limit length of fragment queue
hash table bucket lists").
Best regards,
  Jesper Dangaard Brouer
  MSc.CS, Sr. Network Kernel Developer at Red Hat
  Author of
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists