From owner-freebsd-stable@FreeBSD.ORG Thu Sep 9 18:15:44 2010 Return-Path: Delivered-To: stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3E9F110656AB for ; Thu, 9 Sep 2010 18:15:44 +0000 (UTC) (envelope-from amarat@ksu.ru) Received: from mx7.ksu.ru (honey.ksu.ru [193.232.252.54]) by mx1.freebsd.org (Postfix) with ESMTP id 5ECAC8FC15 for ; Thu, 9 Sep 2010 18:15:42 +0000 (UTC) X-IronPort-AV: E=Sophos;i="4.56,340,1280692800"; d="p7s'?scan'208";a="911749" Received: from mail.ksu.ru (HELO ruby.ksu.ru) ([193.232.252.56]) by iport2.ksu.ru with ESMTP; 09 Sep 2010 22:03:38 +0400 X-Pass-Through: Kazan State University Network Received: from zealot.ksu.ru ([194.85.245.161]) by ksu.ru (8.13.4/8.13.4) with ESMTP id o89I3YWB014552; Thu, 9 Sep 2010 18:03:35 GMT Received: from zealot.ksu.ru (localhost.lnet [127.0.0.1]) by zealot.ksu.ru (8.14.4/8.14.4) with ESMTP id o89I3At5008670; Thu, 9 Sep 2010 22:03:10 +0400 (MSD) (envelope-from amarat@ksu.ru) Message-ID: <4C89215E.7010203@ksu.ru> Date: Thu, 09 Sep 2010 22:03:10 +0400 From: "Marat N.Afanasyev" User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.9.1.11) Gecko/20100724 SeaMonkey/2.0.6 MIME-Version: 1.0 To: Gareth de Vaux , stable@freebsd.org References: <20100909153902.GA28341@lordcow.org> In-Reply-To: <20100909153902.GA28341@lordcow.org> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms060301070401010606060606" X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: Subject: Re: ipfw: Too many dynamic rules X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Sep 2010 18:15:44 -0000 This is a cryptographically signed message in MIME format. --------------ms060301070401010606060606 Content-Type: text/plain; charset=KOI8-R; format=flowed Content-Transfer-Encoding: quoted-printable Gareth de Vaux wrote: > Hi again, I use some keep-state rules in ipfw, but get the following > kernel message: > > kernel: ipfw: install_state: Too many dynamic rules > > when presumably my state table reaches its limit (and I effectively > get DoS'd). > > netstat shows tons of connections in FIN_WAIT_2 state, mostly to > my webserver. Consequently net.inet.ip.fw.dyn_count is large too. > > I can increase my net.inet.ip.fw.dyn_max but the new limit will > simply be reached later on. > > I currently get around this with a cronjob that sets > net.inet.ip.fw.dyn_keepalive to 0 for just less than 5 minutes > every night. If I leave it at 0 for longer or indefinitely then > idle ssh sessions and the like are dropped. This works fine for > me but it looks like there's some bug with net.inet.ip.fw.dyn_keepalive= =3D1? > Or with Apache? > > I'm using 8.1-STABLE, GENERIC kernel. Experienced the same behaviour > on 8.0-RELEASE, but not on 6.1-RELEASE where I had a similar setup. I > have a KeepAliveTimeout of 4 in Apache (2.2.16). > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.or= g" > I wonder, are these dynamic rules really necessary? let's see, a client=20 connects to your web-server and you immediately should create a new=20 dynamic rule, therefore you participate in this DoS attack as well as=20 attacker. ;) may be using ipfw add XXX allow tcp from me 80 to any would be enough? I usually use keep-state rules only for outgoing=20 connections and try to keep number of such rules as few as possible. if=20 you're afraid of somebody trying to attack your servers using unopened=20 connections you may filter out connections that aren't established. you can try to change, of course, net.inet.ip.fw.dyn_*_lifetime variables, but I think that using dynamic rules to filter out web-server = answers is not as good practice as it seems. --=20 SY, Marat --------------ms060301070401010606060606--