Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 12 Jul 2007 01:08:41 +0200
From:      Andre Oppermann <andre@freebsd.org>
To:        Robert Watson <rwatson@FreeBSD.org>
Cc:        Mike Silbersack <silby@silby.com>, current@freebsd.org, net@freebsd.org
Subject:   Re: FreeBSD 7 TCP syncache fix: request for testers
Message-ID:  <469562F9.4060700@freebsd.org>
In-Reply-To: <20070711130719.S68820@fledge.watson.org>
References:  <20070709234401.S29353@odysseus.silby.com>	<20070710132253.GJ1038@void.codelabs.ru>	<20070710202028.I34890@odysseus.silby.com> <20070711130719.S68820@fledge.watson.org>

next in thread | previous in thread | raw e-mail | index | archive | help
Robert Watson wrote:
> On Tue, 10 Jul 2007, Mike Silbersack wrote:
> 
>> On Tue, 10 Jul 2007, Eygene Ryabinkin wrote:
>>
>>> Can't say that I am pushing much traffic through my box, but after 
>>> applying your patch and rebuilding the kernel I am still seeing the 
>>> messages like ----- TCP: [209.132.176.NNN]:NNN to 
>>> [144.206.NNN.NNN]:NNN tcpflags 0x19<FIN,PUSH,ACK>; syncache_expand: 
>>> Segment failed SYNCOOKIE authentication, segment rejected (probably 
>>> spoofed) TCP: [201.90.65.NNN]:NNN to [144.206.NNN.NNN]:NNN; 
>>> syncache_timer: Response timeout ----- But what had changed is that 
>>> the lines with the 'syncache_timer' started to appear.  There were no 
>>> such lines prior to the patch, only the 'failed SYNCOOKIE' ones.
>>
>> The "syncache_timer: Response timeout" message means that the syncache 
>> sent a SYN-ACK response four times, but still didn't receive a 
>> response. This probably means that someone tried using a port scanner 
>> or was going through a faulty firewall.  We'll definitely have to take 
>> that log message out before 7.0 is released.
> 
> As I mentioned to Andre before he committed the log message support, 
> there needs to be an administrative twiddle for it, and pretty much all 
> need to either be rate-limited or turned off by default when we get to 
> the release. Otherwise they make very easy DoS opportunities, especially 
> for systems with serial consoles.

Yes, I'm aware of that and will provide an appropriate patch shortly.

-- 
Andre




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?469562F9.4060700>