From: Phil Oester <kernel@linuxace.com>
To: Patrick McHardy <kaber@trash.net>
Cc: Bob Halley <Bob.Halley@nominum.com>, netfilter-devel@lists.netfilter.org
Subject: Re: Netfilter Connection Tracking Race Condition in Kernel 2.4.x
Date: Tue, 25 Jul 2006 17:54:15 -0700 [thread overview]
Message-ID: <20060726005415.GA18817@linuxace.com> (raw)
In-Reply-To: <44C56ECC.3020107@trash.net>
On Tue, Jul 25, 2006 at 03:07:24AM +0200, Patrick McHardy wrote:
> - change conntrack to always put connections in the hash immediately
> and remove them again if the connection is dropped before beeing
> confirmed.
This could in theory be implemented via an IPS_UNCONFIRMED_BIT (ignoring
the sure to be complicated implementation details). But would there be
any concern about a DOS against the hash if unconfirmed connections
were allowed to enter?
Phil
next prev parent reply other threads:[~2006-07-26 0:54 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-07-25 0:31 Netfilter Connection Tracking Race Condition in Kernel 2.4.x Bob Halley
2006-07-25 1:07 ` Patrick McHardy
2006-07-26 0:54 ` Phil Oester [this message]
2006-07-26 3:56 ` Patrick McHardy
2006-07-26 4:49 ` Yasuyuki KOZAKAI
2006-07-28 13:16 ` [PATCH 4/8][CTNETLINK] Fix race condition on conntrack creation Yasuyuki KOZAKAI
2006-07-31 11:15 ` Pablo Neira Ayuso
2006-08-04 14:43 ` Amin Azez
2006-08-08 10:19 ` Patrick McHardy
-- strict thread matches above, loose matches on Subject: below --
2006-07-25 13:18 Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060726005415.GA18817@linuxace.com \
--to=kernel@linuxace.com \
--cc=Bob.Halley@nominum.com \
--cc=kaber@trash.net \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.