From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66A40ECAAD3 for ; Thu, 1 Sep 2022 16:07:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234851AbiIAQHY (ORCPT ); Thu, 1 Sep 2022 12:07:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234815AbiIAQHN (ORCPT ); Thu, 1 Sep 2022 12:07:13 -0400 Received: from mail-yw1-x112a.google.com (mail-yw1-x112a.google.com [IPv6:2607:f8b0:4864:20::112a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5AAE879A65 for ; Thu, 1 Sep 2022 09:07:11 -0700 (PDT) Received: by mail-yw1-x112a.google.com with SMTP id 00721157ae682-3378303138bso341620177b3.9 for ; Thu, 01 Sep 2022 09:07:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc; bh=aOX3b5WRndoOqWfMYuBPMSz6xrM2daGYXLX/7kwuwZ0=; b=GwWs2TE101XCnPEP8wKR+dSw6GxCCnubsLKNO61paDv/b4aqGIMAG18YmmPLgM7tL/ 9rxLGJP7ak9XNNnjdQbCzL5iB225ng61KZfyh3olNNwiXcwXq+h7ffsMnPZ6pAlJCtYZ bLH1QVrBdzA4VVUk2XpxtrkSITAV/Ux4pJMcF2oCM9VlSnufDfkhwlUbtk195Gwro7U5 g7RY3vz6GYmUmLlUKiLSvS3ZL5u8vzZe1L4nTOO/3oih+NGg56PcP0RM+dkrg4Oj4lO2 Ba4ny5o4vVi/kMzPE7kpTqTkZZ2uDTniFuM40424qKlkBW1erqkUlj7BbmP4i5zxlw0+ FvYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc; bh=aOX3b5WRndoOqWfMYuBPMSz6xrM2daGYXLX/7kwuwZ0=; b=Urtr4rVnFtR7ITdxRDx3RR7j/7d+eRLU7uhfaPMCP2oKv7bvLNn4q9E/TBC9ghIRPV bvV4bW6GTsLQyTcWIk+iYdvaQb7FL0Glud1FaAPv1qs+kdJhCgbDKEciQckrNjPKORIK na2Lt7TTqU/xAEEDRHktTiBKw7GB7ncpAH00S7bS3y26AGXUi39LDHruqUt799XLtNWv U2ayl8wjQ5K/FcGIoUcg/rhxWIZDo6zJEIfAIkW8xj64FAsO4lpAMW5Ih1jP580YOJjI qOy3xsNewB/cd99CEZwlXiaCvk/oADZRrLqNI4N0UmPFABLEtZldG/pI5srUHH9VUl3e +N+Q== X-Gm-Message-State: ACgBeo0utmqcYx8G7NGnr5JTyWZaecVmI+Z9WKOBVyyyhLW+wGfG82UI wlyhaF2+8iWHIlm0gmoL5ZURs8GGmTdsW7GLicU6mQ== X-Google-Smtp-Source: AA6agR4WWi3CPBRYCWEFVbnu2G8pTDzczJE8ASPxBsFd2QD0z+KnsqkUEdVwHr9uF0KxpAAczMEG+KuB9OxJUCT+Ths= X-Received: by 2002:a81:1c4b:0:b0:340:972f:abb0 with SMTP id c72-20020a811c4b000000b00340972fabb0mr23600297ywc.489.1662048430253; Thu, 01 Sep 2022 09:07:10 -0700 (PDT) MIME-Version: 1.0 References: <20220829114648.GA2409@debian> <20220901150115.GB31767@debian> In-Reply-To: <20220901150115.GB31767@debian> From: Eric Dumazet Date: Thu, 1 Sep 2022 09:06:59 -0700 Message-ID: Subject: Re: [PATCH 3/4] net-next: frags: add inetpeer frag_mem tracking To: Richard Gobert Cc: David Miller , Jakub Kicinski , Paolo Abeni , Jonathan Corbet , Hideaki YOSHIFUJI , David Ahern , Alexander Aring , Stefan Schmidt , Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal , Martin KaFai Lau , netdev , "open list:DOCUMENTATION" , LKML , linux-wpan@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Sep 1, 2022 at 8:03 AM Richard Gobert wrote: > > On Mon, Aug 29, 2022 at 03:15:47PM -0700, Eric Dumazet wrote: > > We tried to get rid of any dependence over inetpeer, which is not > > resistant against DDOS attacks. > > > > So I would not add a new dependency. > > I see your point. What do you suggest doing differently? > > The inetpeer mechanism is used for IPv4 frags. If it isn't resistant > against DDoS attacks, can it perhaps be improved? It can be disabled if needed, by changing ipfrag_max_dist sysctl. Quite frankly IPv4 reassembly unit is a toy, I am always surprised some applications are still relying on IP fragments.