From: Eric Dumazet <dada1@cosmosbay.com>
To: David Miller <davem@davemloft.net>
Cc: nikb@webmaster.com, netdev@vger.kernel.org
Subject: Re: RFC: Established connections hash function
Date: Fri, 23 Mar 2007 09:00:08 +0100 [thread overview]
Message-ID: <46038908.6050501@cosmosbay.com> (raw)
In-Reply-To: <20070323.001126.40983698.davem@davemloft.net>
David Miller a écrit :
> From: Eric Dumazet <dada1@cosmosbay.com>
>> Welcome to the club :)
>
> Ok, how about we put something like the following into 2.6.21?
2.6.21 really ?
Just to be clear : I had an attack two years ago, I applied your patch,
rebooted the machine, and since then the attackers had to find another way to
hurt the machine. Eventually, when I update the kernel of this machine, I
forget to appply jhash patch, and attackers dont know they can try again :)
I dont consider this new hash as bug fix at all, ie your patch might enter
2.6.22 normal dev cycle.
Maybe a *fix*, independant of the hash function (so that no math expert can
insult us), would be to have a *limit*, say... 1000 (something insane) on the
length of a hash chain ?
In my case, I saw lengths of about 3000 two years ago under attack, but
machine was still usable... maybe in half power mode.
next prev parent reply other threads:[~2007-03-23 8:00 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-03-22 15:39 RFC: Established connections hash function Nikolaos D. Bougalis
2007-03-22 15:52 ` Evgeniy Polyakov
2007-03-22 17:32 ` Nikolaos D. Bougalis
2007-03-22 18:21 ` Evgeniy Polyakov
2007-03-22 19:44 ` Nikolaos D. Bougalis
2007-03-22 19:56 ` Evgeniy Polyakov
2007-03-22 20:53 ` Nikolaos D. Bougalis
2007-03-23 7:52 ` Evgeniy Polyakov
2007-03-22 20:58 ` David Miller
2007-03-22 22:03 ` Eric Dumazet
2007-03-23 7:11 ` David Miller
2007-03-23 8:00 ` Eric Dumazet [this message]
2007-03-23 18:46 ` David Miller
2007-03-23 8:07 ` Evgeniy Polyakov
2007-03-23 8:17 ` Eric Dumazet
2007-03-23 8:33 ` Evgeniy Polyakov
2007-03-23 9:10 ` Evgeniy Polyakov
2007-03-23 11:58 ` XOR hash beauty solved [Was: RFC: Established connections hash function] Evgeniy Polyakov
2007-03-23 12:51 ` Nikolaos D. Bougalis
2007-03-23 12:45 ` RFC: Established connections hash function Nikolaos D. Bougalis
2007-03-27 14:11 ` Andi Kleen
2007-03-28 5:01 ` Nikolaos D. Bougalis
2007-03-28 6:29 ` David Miller
2007-03-28 9:29 ` Andi Kleen
2007-03-28 10:45 ` Evgeniy Polyakov
2007-03-28 14:14 ` Andi Kleen
2007-03-28 13:50 ` Eric Dumazet
2007-03-28 14:52 ` Andi Kleen
2007-03-29 9:18 ` Evgeniy Polyakov
2007-03-28 14:17 ` RFC: Established connections hash function II Andi Kleen
2007-03-28 19:04 ` RFC: Established connections hash function David Miller
2007-03-28 20:12 ` Andi Kleen
-- strict thread matches above, loose matches on Subject: below --
2007-03-24 12:26 linux
2007-03-24 13:29 ` Evgeniy Polyakov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=46038908.6050501@cosmosbay.com \
--to=dada1@cosmosbay.com \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=nikb@webmaster.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.