netdev - Re: [PATCH] net: bridge: add max_fdb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171116030107.GI2130@lunn.ch>
Date:   Thu, 16 Nov 2017 04:01:07 +0100
From:   Andrew Lunn <andrew@...n.ch>
To:     Sarah Newman <srn@...mr.com>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH] net: bridge: add max_fdb_count

> @@ -556,6 +559,10 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
>  	if (hold_time(br) == 0)
>  		return;
>  
> +	/* Place maximum on number of learned entries. */
> +	if (br->max_fdb_count <= br->fdb_count)
> +		return;
> +

Hi Sarah

We probably want a rate limited warning printed here. If the table is
full, it will have to start flooding frames, which is not good for
performance. Having something in the log will help debug the problem.
The log will also give a hit that a DoS attack could be happening.

    Andrew