aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux/dccp.h
diff options
context:
space:
mode:
authorGerrit Renker <gerrit@erg.abdn.ac.uk>2007-09-26 10:31:49 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-10-10 19:52:43 -0400
commita94f0f970549e63e54c80c4509db299c514d8c11 (patch)
tree3b9421fc70e00c16ed57ef4330b24504b04ae309 /include/linux/dccp.h
parentee1a15922d356aff0e31bf9bb9088ab346b8033a (diff)
[DCCP]: Rate-limit DCCP-Syncs
This implements a SHOULD from RFC 4340, 7.5.4: "To protect against denial-of-service attacks, DCCP implementations SHOULD impose a rate limit on DCCP-Syncs sent in response to sequence-invalid packets, such as not more than eight DCCP-Syncs per second." The rate-limit is maintained on a per-socket basis. This is a more stringent policy than enforcing the rate-limit on a per-source-address basis and protects against attacks with forged source addresses. Moreover, the mechanism is deliberately kept simple. In contrast to xrlim_allow(), bursts of Sync packets in reply to sequence-invalid packets are not supported. This foils such attacks where the receipt of a Sync triggers further sequence-invalid packets. (I have tested this mechanism against xrlim_allow algorithm for Syncs, permitting bursts just increases the problems.) In order to keep flexibility, the timeout parameter can be set via sysctl; and the whole mechanism can even be disabled (which is however not recommended). The algorithm in this patch has been improved with regard to wrapping issues thanks to a suggestion by Arnaldo. Commiter note: Rate limited the step 6 DCCP_WARN too, as it says we're sending a sync. Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz> Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Diffstat (limited to 'include/linux/dccp.h')
-rw-r--r--include/linux/dccp.h2
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 20e0717aa8e1..4ed82e2c9f65 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -470,6 +470,7 @@ struct dccp_ackvec;
470 * @dccps_pcrlen - receiver partial checksum coverage (via sockopt) 470 * @dccps_pcrlen - receiver partial checksum coverage (via sockopt)
471 * @dccps_ndp_count - number of Non Data Packets since last data packet 471 * @dccps_ndp_count - number of Non Data Packets since last data packet
472 * @dccps_mss_cache - current value of MSS (path MTU minus header sizes) 472 * @dccps_mss_cache - current value of MSS (path MTU minus header sizes)
473 * @dccps_rate_last - timestamp for rate-limiting DCCP-Sync (RFC 4340, 7.5.4)
473 * @dccps_minisock - associated minisock (accessed via dccp_msk) 474 * @dccps_minisock - associated minisock (accessed via dccp_msk)
474 * @dccps_hc_rx_ackvec - rx half connection ack vector 475 * @dccps_hc_rx_ackvec - rx half connection ack vector
475 * @dccps_hc_rx_ccid - CCID used for the receiver (or receiving half-connection) 476 * @dccps_hc_rx_ccid - CCID used for the receiver (or receiving half-connection)
@@ -505,6 +506,7 @@ struct dccp_sock {
505 __u16 dccps_pcrlen; 506 __u16 dccps_pcrlen;
506 unsigned long dccps_ndp_count; 507 unsigned long dccps_ndp_count;
507 __u32 dccps_mss_cache; 508 __u32 dccps_mss_cache;
509 unsigned long dccps_rate_last;
508 struct dccp_minisock dccps_minisock; 510 struct dccp_minisock dccps_minisock;
509 struct dccp_ackvec *dccps_hc_rx_ackvec; 511 struct dccp_ackvec *dccps_hc_rx_ackvec;
510 struct ccid *dccps_hc_rx_ccid; 512 struct ccid *dccps_hc_rx_ccid;