Re: [PATCH,RFC] explicit connection confirmation

[bert hubert <ahu@xxxxxxx>]

On Thu, Nov 07, 2002 at 07:09:56AM -0500, Lennert Buytenhek wrote:

> > I think this approach smells, btw - doesn't this mean that processes
> > will now be woken up on receiving a SYN instead of after completion
> > of the handshake?
> 
> Yes, it does mean this.  You are free to suggest alternatives.

I like having this ability - I dislike offering it to an unsuspecting
userspace.

> > Would make a synflood all the more interesting..
> 
> In case of a synflood, the TCP stack will fall back to sending
> syncookies as it normally does.

Yes, but in your setup, a spoofable SYN packet will spawn a process for many
daemons, unless they are modified to first try to read/write to the socket
(which might block!) before forking/pthread_create()ing.

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO