diff options
author | Gerrit Renker <gerrit@erg.abdn.ac.uk> | 2007-09-26 10:31:49 -0400 |
---|---|---|
committer | David S. Miller <davem@sunset.davemloft.net> | 2007-10-10 19:52:43 -0400 |
commit | a94f0f970549e63e54c80c4509db299c514d8c11 (patch) | |
tree | 3b9421fc70e00c16ed57ef4330b24504b04ae309 /net/dccp/input.c | |
parent | ee1a15922d356aff0e31bf9bb9088ab346b8033a (diff) |
[DCCP]: Rate-limit DCCP-Syncs
This implements a SHOULD from RFC 4340, 7.5.4:
"To protect against denial-of-service attacks, DCCP implementations SHOULD
impose a rate limit on DCCP-Syncs sent in response to sequence-invalid packets,
such as not more than eight DCCP-Syncs per second."
The rate-limit is maintained on a per-socket basis. This is a more stringent
policy than enforcing the rate-limit on a per-source-address basis and
protects against attacks with forged source addresses.
Moreover, the mechanism is deliberately kept simple. In contrast to
xrlim_allow(), bursts of Sync packets in reply to sequence-invalid packets
are not supported. This foils such attacks where the receipt of a Sync
triggers further sequence-invalid packets. (I have tested this mechanism against
xrlim_allow algorithm for Syncs, permitting bursts just increases the problems.)
In order to keep flexibility, the timeout parameter can be set via sysctl; and
the whole mechanism can even be disabled (which is however not recommended).
The algorithm in this patch has been improved with regard to wrapping issues
thanks to a suggestion by Arnaldo.
Commiter note: Rate limited the step 6 DCCP_WARN too, as it says we're
sending a sync.
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Diffstat (limited to 'net/dccp/input.c')
-rw-r--r-- | net/dccp/input.c | 29 |
1 files changed, 20 insertions, 9 deletions
diff --git a/net/dccp/input.c b/net/dccp/input.c index 86ad3ba0649a..19d7e1dbd87e 100644 --- a/net/dccp/input.c +++ b/net/dccp/input.c | |||
@@ -122,6 +122,23 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb) | |||
122 | (ackno != DCCP_PKT_WITHOUT_ACK_SEQ)) | 122 | (ackno != DCCP_PKT_WITHOUT_ACK_SEQ)) |
123 | dp->dccps_gar = ackno; | 123 | dp->dccps_gar = ackno; |
124 | } else { | 124 | } else { |
125 | unsigned long now = jiffies; | ||
126 | /* | ||
127 | * Step 6: Check sequence numbers | ||
128 | * Otherwise, | ||
129 | * If P.type == Reset, | ||
130 | * Send Sync packet acknowledging S.GSR | ||
131 | * Otherwise, | ||
132 | * Send Sync packet acknowledging P.seqno | ||
133 | * Drop packet and return | ||
134 | * | ||
135 | * These Syncs are rate-limited as per RFC 4340, 7.5.4: | ||
136 | * at most 1 / (dccp_sync_rate_limit * HZ) Syncs per second. | ||
137 | */ | ||
138 | if (time_before(now, (dp->dccps_rate_last + | ||
139 | sysctl_dccp_sync_ratelimit))) | ||
140 | return 0; | ||
141 | |||
125 | DCCP_WARN("DCCP: Step 6 failed for %s packet, " | 142 | DCCP_WARN("DCCP: Step 6 failed for %s packet, " |
126 | "(LSWL(%llu) <= P.seqno(%llu) <= S.SWH(%llu)) and " | 143 | "(LSWL(%llu) <= P.seqno(%llu) <= S.SWH(%llu)) and " |
127 | "(P.ackno %s or LAWL(%llu) <= P.ackno(%llu) <= S.AWH(%llu), " | 144 | "(P.ackno %s or LAWL(%llu) <= P.ackno(%llu) <= S.AWH(%llu), " |
@@ -132,15 +149,9 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb) | |||
132 | : "exists", | 149 | : "exists", |
133 | (unsigned long long) lawl, (unsigned long long) ackno, | 150 | (unsigned long long) lawl, (unsigned long long) ackno, |
134 | (unsigned long long) dp->dccps_awh); | 151 | (unsigned long long) dp->dccps_awh); |
135 | /* | 152 | |
136 | * Step 6: Check sequence numbers | 153 | dp->dccps_rate_last = now; |
137 | * Otherwise, | 154 | |
138 | * If P.type == Reset, | ||
139 | * Send Sync packet acknowledging S.GSR | ||
140 | * Otherwise, | ||
141 | * Send Sync packet acknowledging P.seqno | ||
142 | * Drop packet and return | ||
143 | */ | ||
144 | if (dh->dccph_type == DCCP_PKT_RESET) | 155 | if (dh->dccph_type == DCCP_PKT_RESET) |
145 | seqno = dp->dccps_gsr; | 156 | seqno = dp->dccps_gsr; |
146 | dccp_send_sync(sk, seqno, DCCP_PKT_SYNC); | 157 | dccp_send_sync(sk, seqno, DCCP_PKT_SYNC); |