|author||Gerrit Renker <email@example.com>||2007-09-26 11:31:49 -0300|
|committer||David S. Miller <firstname.lastname@example.org>||2007-10-10 16:52:43 -0700|
|parent||[DCCP]: Remove duplicate code for Reset from connected socket (diff)|
[DCCP]: Rate-limit DCCP-Syncs
This implements a SHOULD from RFC 4340, 7.5.4: "To protect against denial-of-service attacks, DCCP implementations SHOULD impose a rate limit on DCCP-Syncs sent in response to sequence-invalid packets, such as not more than eight DCCP-Syncs per second." The rate-limit is maintained on a per-socket basis. This is a more stringent policy than enforcing the rate-limit on a per-source-address basis and protects against attacks with forged source addresses. Moreover, the mechanism is deliberately kept simple. In contrast to xrlim_allow(), bursts of Sync packets in reply to sequence-invalid packets are not supported. This foils such attacks where the receipt of a Sync triggers further sequence-invalid packets. (I have tested this mechanism against xrlim_allow algorithm for Syncs, permitting bursts just increases the problems.) In order to keep flexibility, the timeout parameter can be set via sysctl; and the whole mechanism can even be disabled (which is however not recommended). The algorithm in this patch has been improved with regard to wrapping issues thanks to a suggestion by Arnaldo. Commiter note: Rate limited the step 6 DCCP_WARN too, as it says we're sending a sync. Signed-off-by: Gerrit Renker <email@example.com> Signed-off-by: Ian McDonald <firstname.lastname@example.org> Signed-off-by: Arnaldo Carvalho de Melo <email@example.com>
Diffstat (limited to 'Documentation')
1 files changed, 5 insertions, 0 deletions
diff --git a/Documentation/networking/dccp.txt b/Documentation/networking/dccp.txt
index 4504cc59e405..477026ae0ffb 100644
@@ -112,6 +112,11 @@ tx_qlen = 5
The size of the transmit buffer in packets. A value of 0 corresponds
to an unbounded transmit buffer.
+sync_ratelimit = 125 ms
+ The timeout between subsequent DCCP-Sync packets sent in response to
+ sequence-invalid packets on the same socket (RFC 4340, 7.5.4). The unit
+ of this parameter is milliseconds; a value of 0 disables rate-limiting.