From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751994AbcCHVLV (ORCPT ); Tue, 8 Mar 2016 16:11:21 -0500 Received: from mx1.redhat.com ([209.132.183.28]:42245 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751396AbcCHVLM convert rfc822-to-8bit (ORCPT ); Tue, 8 Mar 2016 16:11:12 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20160308.151311.928321529565045584.davem@davemloft.net> References: <20160308.151311.928321529565045584.davem@davemloft.net> <20160307143806.18567.30020.stgit@warthog.procyon.org.uk> <23389.1457390714@warthog.procyon.org.uk> <29908.1457437197@warthog.procyon.org.uk> To: David Miller Cc: dhowells@redhat.com, linux-afs@lists.infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 01/11] rxrpc: Add a common object cache MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <24949.1457471469.1@warthog.procyon.org.uk> Content-Transfer-Encoding: 8BIT Date: Tue, 08 Mar 2016 21:11:09 +0000 Message-ID: <24950.1457471469@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org David Miller wrote: > > One could argue, I suppose, that things should've been arranged that the > > RxRPC client would manage the lifetime of each connection it sets up, > > rather than both ends letting it lapse by mutual loss of interest. But > > you *still* have to have a timeout, lest the client die and not close its > > connection. > > But the point is if there is no limitation on the number of these connections > that can be setup.... wait for troubles. > > And if you try to put in some kind of limit to handle this, it's then > easy for the bad guy to block out other legitimate users. I can put in a limit per peer, where a 'peer' is either a particular remote UDP port or particulat remote host. TCP has this by virtue of having a limited number of ports available per IP address. But if I have 10 IP addresses available, I can attempt to set up half a million TCP connections to a server simultaneously. If I have access to a box that has an NFS mount on it, I can potentially open sufficient TCP ports that the NFS mount can't make a connection if it's not allowed to use privileged ports. Am I right in thinking that you have decided that it can't be done and shouldn't be done? David