Re: Fw: Local Denial-of-Service attack against Linux

From: David S. Miller (davem@redhat.com)
Date: Sun Mar 26 2000 - 06:47:30 EST


   Date: Sun, 26 Mar 2000 12:40:08 +0200
   From: Manfred Spraul <manfreds@colorfullife.com>

   Doesn't restore the original send buffer, it doubles the send buffer
   size.

You are assuming that sysctl values and socket option settings
are equivalent, they are not.

We double on setsockopt SNDBUF to be more compatible about the
meaning of the send buffer size with other systems. Most systems
take it to mean the amount of data bytes that can be sent into
the socket at one time, to be more immune to massive memory usage
attacks we handle things differently.

When we allocate packet buffers, we act as if we are eating into twice
the amount of sk->sndbuf bytes as the data length. This is to account
for the extra overheads assosciated with the packet buffer struct and
protocol header bytes. For example, when the user sends 1 byte of
data over a socket, he is actually using a lot more memory than that
(1 data byte + sizeof(protocol headers) + sizeof(struct sk_buff)).

So now that you know this, try sending (sysctl_wmem_default / 2) to
the SNDBUF setsockopt, and you'll get the results you want because now
you know the proper units of those two values.

We've been doing things this way for as long as I can remember and
it doesn't cause any problems.

Later,
David S. Miller
davem@redhat.com

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Fri Mar 31 2000 - 21:00:17 EST