From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: [PATCH 3/3 XFRM]: Fix invalid key for lookup of cached bundles Date: Mon, 07 Mar 2005 02:55:03 +0100 Message-ID: <422BB477.3040607@trash.net> References: <422AF8D0.3010905@trash.net> <20050307012458.GA4335@gondor.apana.org.au> <422BB14A.5030302@trash.net> <20050307014337.GA4451@gondor.apana.org.au> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: davem@davemloft.net, netdev@oss.sgi.com To: Herbert Xu In-Reply-To: <20050307014337.GA4451@gondor.apana.org.au> Sender: netdev-bounce@oss.sgi.com Errors-to: netdev-bounce@oss.sgi.com List-Id: netdev.vger.kernel.org Herbert Xu wrote: > On Mon, Mar 07, 2005 at 02:41:30AM +0100, Patrick McHardy wrote: >> >>Mainly to avoid excessive long lists of cached bundles in tunnel >>mode. The use of a single list for the cache is questionable, but >>the patch was supposed to fix a different issue. Restricting use >>of tos/mark to transport mode avoids having exploding lists that >>are easily remotely triggerable. > > > That's a different problem. You can already create arbitrarily > long bundle lists by spoofing src/dst addresses... But I don't want to make it worse. The number is still restricted by the scope of the selector, using tos and fwmark makes the worst case a lot worse. Regards Patrick