Date: Mon, 18 Jun 2012 17:11:24 +0000 (UTC) From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r237230 - head/sys/netinet Message-ID: <201206181711.q5IHBO9i090717@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tuexen Date: Mon Jun 18 17:11:24 2012 New Revision: 237230 URL: http://svn.freebsd.org/changeset/base/237230 Log: Add rate limitation for SCTP OOTB responses. MFC after: 3 days Modified: head/sys/netinet/icmp_var.h head/sys/netinet/ip_icmp.c head/sys/netinet/sctp_input.c Modified: head/sys/netinet/icmp_var.h ============================================================================== --- head/sys/netinet/icmp_var.h Mon Jun 18 17:09:39 2012 (r237229) +++ head/sys/netinet/icmp_var.h Mon Jun 18 17:11:24 2012 (r237230) @@ -102,7 +102,8 @@ extern int badport_bandlim(int); #define BANDLIM_RST_CLOSEDPORT 3 /* No connection, and no listeners */ #define BANDLIM_RST_OPENPORT 4 /* No connection, listener */ #define BANDLIM_ICMP6_UNREACH 5 -#define BANDLIM_MAX 5 +#define BANDLIM_SCTP_OOTB 6 +#define BANDLIM_MAX 6 #endif #endif Modified: head/sys/netinet/ip_icmp.c ============================================================================== --- head/sys/netinet/ip_icmp.c Mon Jun 18 17:09:39 2012 (r237229) +++ head/sys/netinet/ip_icmp.c Mon Jun 18 17:11:24 2012 (r237230) @@ -965,7 +965,8 @@ badport_bandlim(int which) { "icmp tstamp response" }, { "closed port RST response" }, { "open port RST response" }, - { "icmp6 unreach response" } + { "icmp6 unreach response" }, + { "sctp ootb response" } }; /* Modified: head/sys/netinet/sctp_input.c ============================================================================== --- head/sys/netinet/sctp_input.c Mon Jun 18 17:09:39 2012 (r237229) +++ head/sys/netinet/sctp_input.c Mon Jun 18 17:11:24 2012 (r237230) @@ -6060,15 +6060,8 @@ sctp_skip_csum_4: struct sctp_init_chunk *init_chk, chunk_buf; SCTP_STAT_INCR(sctps_noport); -#ifdef ICMP_BANDLIM - /* - * we use the bandwidth limiting to protect against sending - * too many ABORTS all at once. In this case these count the - * same as an ICMP message. - */ - if (badport_bandlim(0) < 0) + if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) goto bad; -#endif /* ICMP_BANDLIM */ SCTPDBG(SCTP_DEBUG_INPUT1, "Sending a ABORT from packet entry!\n"); if (ch->chunk_type == SCTP_INITIATION) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201206181711.q5IHBO9i090717>