aboutsummaryrefslogtreecommitdiffstats
path: root/net/dccp/input.c
diff options
context:
space:
mode:
authorGerrit Renker <gerrit@erg.abdn.ac.uk>2007-09-26 10:31:49 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-10-10 19:52:43 -0400
commita94f0f970549e63e54c80c4509db299c514d8c11 (patch)
tree3b9421fc70e00c16ed57ef4330b24504b04ae309 /net/dccp/input.c
parentee1a15922d356aff0e31bf9bb9088ab346b8033a (diff)
[DCCP]: Rate-limit DCCP-Syncs
This implements a SHOULD from RFC 4340, 7.5.4: "To protect against denial-of-service attacks, DCCP implementations SHOULD impose a rate limit on DCCP-Syncs sent in response to sequence-invalid packets, such as not more than eight DCCP-Syncs per second." The rate-limit is maintained on a per-socket basis. This is a more stringent policy than enforcing the rate-limit on a per-source-address basis and protects against attacks with forged source addresses. Moreover, the mechanism is deliberately kept simple. In contrast to xrlim_allow(), bursts of Sync packets in reply to sequence-invalid packets are not supported. This foils such attacks where the receipt of a Sync triggers further sequence-invalid packets. (I have tested this mechanism against xrlim_allow algorithm for Syncs, permitting bursts just increases the problems.) In order to keep flexibility, the timeout parameter can be set via sysctl; and the whole mechanism can even be disabled (which is however not recommended). The algorithm in this patch has been improved with regard to wrapping issues thanks to a suggestion by Arnaldo. Commiter note: Rate limited the step 6 DCCP_WARN too, as it says we're sending a sync. Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz> Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Diffstat (limited to 'net/dccp/input.c')
-rw-r--r--net/dccp/input.c29
1 files changed, 20 insertions, 9 deletions
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 86ad3ba0649a..19d7e1dbd87e 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -122,6 +122,23 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
122 (ackno != DCCP_PKT_WITHOUT_ACK_SEQ)) 122 (ackno != DCCP_PKT_WITHOUT_ACK_SEQ))
123 dp->dccps_gar = ackno; 123 dp->dccps_gar = ackno;
124 } else { 124 } else {
125 unsigned long now = jiffies;
126 /*
127 * Step 6: Check sequence numbers
128 * Otherwise,
129 * If P.type == Reset,
130 * Send Sync packet acknowledging S.GSR
131 * Otherwise,
132 * Send Sync packet acknowledging P.seqno
133 * Drop packet and return
134 *
135 * These Syncs are rate-limited as per RFC 4340, 7.5.4:
136 * at most 1 / (dccp_sync_rate_limit * HZ) Syncs per second.
137 */
138 if (time_before(now, (dp->dccps_rate_last +
139 sysctl_dccp_sync_ratelimit)))
140 return 0;
141
125 DCCP_WARN("DCCP: Step 6 failed for %s packet, " 142 DCCP_WARN("DCCP: Step 6 failed for %s packet, "
126 "(LSWL(%llu) <= P.seqno(%llu) <= S.SWH(%llu)) and " 143 "(LSWL(%llu) <= P.seqno(%llu) <= S.SWH(%llu)) and "
127 "(P.ackno %s or LAWL(%llu) <= P.ackno(%llu) <= S.AWH(%llu), " 144 "(P.ackno %s or LAWL(%llu) <= P.ackno(%llu) <= S.AWH(%llu), "
@@ -132,15 +149,9 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
132 : "exists", 149 : "exists",
133 (unsigned long long) lawl, (unsigned long long) ackno, 150 (unsigned long long) lawl, (unsigned long long) ackno,
134 (unsigned long long) dp->dccps_awh); 151 (unsigned long long) dp->dccps_awh);
135 /* 152
136 * Step 6: Check sequence numbers 153 dp->dccps_rate_last = now;
137 * Otherwise, 154
138 * If P.type == Reset,
139 * Send Sync packet acknowledging S.GSR
140 * Otherwise,
141 * Send Sync packet acknowledging P.seqno
142 * Drop packet and return
143 */
144 if (dh->dccph_type == DCCP_PKT_RESET) 155 if (dh->dccph_type == DCCP_PKT_RESET)
145 seqno = dp->dccps_gsr; 156 seqno = dp->dccps_gsr;
146 dccp_send_sync(sk, seqno, DCCP_PKT_SYNC); 157 dccp_send_sync(sk, seqno, DCCP_PKT_SYNC);