[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120103204943.GA4123@openwall.com>
Date: Wed, 4 Jan 2012 00:49:43 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: speaking of DoS, openssh and dropbear (CVE-2006-1206)
Hi,
One of the ideas I have is to make the per-source limit(s) dynamic -
based on the remaining number of free slots (for a given category, if
applicable - e.g., with per-netblock limits).
The attached Perl script simulates a worst-case scenario for an
algorithm implementing this. Specifically, with 1000 slots and
allocations starting at 10 slots per source (and reducing all the way to
1 per source as we're about to run out of free slots), we're able to
accept connections from at least 292 different source addresses.
With 1000 slots, but starting at 50 slots per source, we're able to
accept connections from at least 88 different source addresses.
$ ./persource.pl | wc -l
292
$ for n in {10..1}; do ./persource.pl | fgrep -cx $n; done
10
12
12
14
17
20
24
34
49
100
Alexander
View attachment "persource.pl" of type "text/plain" (333 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
