From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:38232)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1XgVqx-00046p-GK
	for qemu-devel@nongnu.org; Tue, 21 Oct 2014 05:35:49 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1XgVqp-0005Eo-4d
	for qemu-devel@nongnu.org; Tue, 21 Oct 2014 05:35:43 -0400
Received: from mx1.redhat.com ([209.132.183.28]:9833)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1XgVqo-0005Ei-Mt
	for qemu-devel@nongnu.org; Tue, 21 Oct 2014 05:35:35 -0400
Message-ID: <1413884106.14632.8.camel@nilsson.home.kraxel.org>
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Tue, 21 Oct 2014 11:35:06 +0200
In-Reply-To: <544622E9.4020105@huawei.com>
References: <1413375585-20301-1-git-send-email-kraxel@redhat.com>
	<1413375585-20301-7-git-send-email-kraxel@redhat.com>
	<20141015123110.GA3741@redhat.com>
	<1413382769.4213.5.camel@nilsson.home.kraxel.org>
	<20141015143915.GE3741@redhat.com>
	<1413456389.18160.1.camel@nilsson.home.kraxel.org>
	<5440B85F.3060307@huawei.com>
	<1413788563.3509.7.camel@nilsson.home.kraxel.org>
	<5445F7D1.5060903@huawei.com>
	<1413881843.14632.6.camel@nilsson.home.kraxel.org>
	<544622E9.4020105@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 6/6] vnc: track & limit connections
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Gonglei <arei.gonglei@huawei.com>
Cc: "Huangweidong (C)" <weidong.huang@huawei.com>, "Huangpeng (Peter)" <peter.huangpeng@huawei.com>, "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>, Anthony Liguori <aliguori@amazon.com>, "Dr. David
	Alan Gilbert" <dgilbert@redhat.com>

  Hi,

> Yes. But I think it is not a big problem, when the REJECT_TIME is over,
> the good guys can connect vnc successfully immediately.
> Or maybe we just lock those guys with "the same Source IP address" ?

Better.  Question is whenever we really want implement those schemes
within qemu or leave that to the firewall to handle (connlimit comes to
mind, see "man iptables-extensions").

Doing it in qemu IMO only makes sense when using information the
firewall doesn't have.  With sasl enabled we can slow down login
attempts *per user* for example.

cheers,
  Gerd