summaryrefslogtreecommitdiff
path: root/net/dccp/sysctl.c
diff options
context:
space:
mode:
authorGerrit Renker <gerrit@erg.abdn.ac.uk>2007-09-26 18:31:49 +0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-10-11 03:52:43 +0400
commita94f0f970549e63e54c80c4509db299c514d8c11 (patch)
tree3b9421fc70e00c16ed57ef4330b24504b04ae309 /net/dccp/sysctl.c
parentee1a15922d356aff0e31bf9bb9088ab346b8033a (diff)
downloadlinux-a94f0f970549e63e54c80c4509db299c514d8c11.tar.xz
[DCCP]: Rate-limit DCCP-Syncs
This implements a SHOULD from RFC 4340, 7.5.4: "To protect against denial-of-service attacks, DCCP implementations SHOULD impose a rate limit on DCCP-Syncs sent in response to sequence-invalid packets, such as not more than eight DCCP-Syncs per second." The rate-limit is maintained on a per-socket basis. This is a more stringent policy than enforcing the rate-limit on a per-source-address basis and protects against attacks with forged source addresses. Moreover, the mechanism is deliberately kept simple. In contrast to xrlim_allow(), bursts of Sync packets in reply to sequence-invalid packets are not supported. This foils such attacks where the receipt of a Sync triggers further sequence-invalid packets. (I have tested this mechanism against xrlim_allow algorithm for Syncs, permitting bursts just increases the problems.) In order to keep flexibility, the timeout parameter can be set via sysctl; and the whole mechanism can even be disabled (which is however not recommended). The algorithm in this patch has been improved with regard to wrapping issues thanks to a suggestion by Arnaldo. Commiter note: Rate limited the step 6 DCCP_WARN too, as it says we're sending a sync. Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz> Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Diffstat (limited to 'net/dccp/sysctl.c')
-rw-r--r--net/dccp/sysctl.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/net/dccp/sysctl.c b/net/dccp/sysctl.c
index 1260aabac5e1..9364b2fb4dbd 100644
--- a/net/dccp/sysctl.c
+++ b/net/dccp/sysctl.c
@@ -18,6 +18,9 @@
#error This file should not be compiled without CONFIG_SYSCTL defined
#endif
+/* rate-limit for syncs in reply to sequence-invalid packets; RFC 4340, 7.5.4 */
+int sysctl_dccp_sync_ratelimit __read_mostly = HZ / 8;
+
static struct ctl_table dccp_default_table[] = {
{
.procname = "seq_window",
@@ -89,6 +92,13 @@ static struct ctl_table dccp_default_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec,
},
+ {
+ .procname = "sync_ratelimit",
+ .data = &sysctl_dccp_sync_ratelimit,
+ .maxlen = sizeof(sysctl_dccp_sync_ratelimit),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_ms_jiffies,
+ },
{ .ctl_name = 0, }
};