From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751498AbcCIDAK (ORCPT ); Tue, 8 Mar 2016 22:00:10 -0500 Received: from shards.monkeyblade.net ([149.20.54.216]:48856 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751276AbcCIDAH (ORCPT ); Tue, 8 Mar 2016 22:00:07 -0500 Date: Tue, 08 Mar 2016 22:00:04 -0500 (EST) Message-Id: <20160308.220004.1907883099752626015.davem@davemloft.net> To: dhowells@redhat.com Cc: linux-afs@lists.infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 01/11] rxrpc: Add a common object cache From: David Miller In-Reply-To: <24950.1457471469@warthog.procyon.org.uk> References: <23389.1457390714@warthog.procyon.org.uk> <29908.1457437197@warthog.procyon.org.uk> <24950.1457471469@warthog.procyon.org.uk> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Tue, 08 Mar 2016 19:00:06 -0800 (PST) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: David Howells Date: Tue, 08 Mar 2016 21:11:09 +0000 > I can put in a limit per peer, where a 'peer' is either a particular remote > UDP port or particulat remote host. TCP has this by virtue of having a > limited number of ports available per IP address. But if I have 10 IP > addresses available, I can attempt to set up half a million TCP connections to > a server simultaneously. If I have access to a box that has an NFS mount on > it, I can potentially open sufficient TCP ports that the NFS mount can't make > a connection if it's not allowed to use privileged ports. You must hold onto and commit locally to state for each and every one of those remote TCP connections you create and actually move to established state. It's completely different, both sides have to make a non-trivial resource commitment. For this RXRPC stuff, you don't. That's the important and critical difference. My core argument still stands that RXRPC is fundamental DoS'able, in a way that is not matched by TCP or our routing code or similar subsystems.