From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:47961)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <arei.gonglei@huawei.com>) id 1XgWl9-0000v8-IC
	for qemu-devel@nongnu.org; Tue, 21 Oct 2014 06:33:53 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <arei.gonglei@huawei.com>) id 1XgWl3-0000vn-DD
	for qemu-devel@nongnu.org; Tue, 21 Oct 2014 06:33:47 -0400
Received: from szxga01-in.huawei.com ([119.145.14.64]:39493)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <arei.gonglei@huawei.com>) id 1XgWl2-0000vZ-Og
	for qemu-devel@nongnu.org; Tue, 21 Oct 2014 06:33:41 -0400
Message-ID: <54463652.4020200@huawei.com>
Date: Tue, 21 Oct 2014 18:32:50 +0800
From: Gonglei <arei.gonglei@huawei.com>
MIME-Version: 1.0
References: <1413375585-20301-1-git-send-email-kraxel@redhat.com>
	<1413375585-20301-7-git-send-email-kraxel@redhat.com>
	<20141015123110.GA3741@redhat.com>
	<1413382769.4213.5.camel@nilsson.home.kraxel.org>
	<20141015143915.GE3741@redhat.com>
	<1413456389.18160.1.camel@nilsson.home.kraxel.org>
	<5440B85F.3060307@huawei.com>
	<1413788563.3509.7.camel@nilsson.home.kraxel.org>
	<5445F7D1.5060903@huawei.com>
	<1413881843.14632.6.camel@nilsson.home.kraxel.org>
	<544622E9.4020105@huawei.com>
	<1413884106.14632.8.camel@nilsson.home.kraxel.org>
In-Reply-To: <1413884106.14632.8.camel@nilsson.home.kraxel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 6/6] vnc: track & limit connections
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Gerd Hoffmann <kraxel@redhat.com>
Cc: "Huangweidong (C)" <weidong.huang@huawei.com>, "Huangpeng (Peter)" <peter.huangpeng@huawei.com>, "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>, Anthony Liguori <aliguori@amazon.com>, "Dr. David
	Alan Gilbert" <dgilbert@redhat.com>

On 2014/10/21 17:35, Gerd Hoffmann wrote:

>   Hi,
> 
>> Yes. But I think it is not a big problem, when the REJECT_TIME is over,
>> the good guys can connect vnc successfully immediately.
>> Or maybe we just lock those guys with "the same Source IP address" ?
> 
> Better.  Question is whenever we really want implement those schemes
> within qemu or leave that to the firewall to handle (connlimit comes to
> mind, see "man iptables-extensions").
> 

Got it.

> Doing it in qemu IMO only makes sense when using information the
> firewall doesn't have.  With sasl enabled we can slow down login
> attempts *per user* for example.
> 

OK. Thanks for your opinion. :)

Best regards,
-Gonglei