d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add rate limitation for SCTP OOTB responses.

Browse Source 
MFC after: 3 days
This commit is contained in:
tuexen 2012-06-18 17:11:24 +00:00
parent 2cb9af1cef
commit be8d1bbb92
3 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/netinet/icmp_var.h
View File

@ -102,7 +102,8 @@ extern int badport_bandlim(int);
#define BANDLIM_RST_CLOSEDPORT 3 /* No connection, and no listeners */ #define BANDLIM_RST_CLOSEDPORT 3 /* No connection, and no listeners */
#define BANDLIM_RST_OPENPORT 4 /* No connection, listener */ #define BANDLIM_RST_OPENPORT 4 /* No connection, listener */
#define BANDLIM_ICMP6_UNREACH 5 #define BANDLIM_ICMP6_UNREACH 5
#define BANDLIM_MAX 5 #define BANDLIM_SCTP_OOTB 6
#define BANDLIM_MAX 6
#endif #endif
#endif #endif

3
sys/netinet/ip_icmp.c
View File

@ -965,7 +965,8 @@ badport_bandlim(int which)
{ "icmp tstamp response" }, { "icmp tstamp response" },
{ "closed port RST response" }, { "closed port RST response" },
{ "open port RST response" }, { "open port RST response" },
{ "icmp6 unreach response" } { "icmp6 unreach response" },
{ "sctp ootb response" }
}; };
/* /*

9
sys/netinet/sctp_input.c
View File

@ -6060,15 +6060,8 @@ sctp_skip_csum_4:
struct sctp_init_chunk *init_chk, chunk_buf; struct sctp_init_chunk *init_chk, chunk_buf;
SCTP_STAT_INCR(sctps_noport); SCTP_STAT_INCR(sctps_noport);
#ifdef ICMP_BANDLIM if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0)
/*
* we use the bandwidth limiting to protect against sending
* too many ABORTS all at once. In this case these count the
* same as an ICMP message.
*/
if (badport_bandlim(0) < 0)
goto bad; goto bad;
#endif /* ICMP_BANDLIM */
SCTPDBG(SCTP_DEBUG_INPUT1, SCTPDBG(SCTP_DEBUG_INPUT1,
"Sending a ABORT from packet entry!\n"); "Sending a ABORT from packet entry!\n");
if (ch->chunk_type == SCTP_INITIATION) { if (ch->chunk_type == SCTP_INITIATION) {