Re: net: rps: support 802.1Q
flat view
From: Changli Gao <hidden>
Date: 2011-08-19 15:05:39
On Fri, Aug 19, 2011 at 7:54 PM, Ben Hutchings [off-list ref] wrote:
Should this really be reading an unlimited number of tags?
Not unlimited, but it won't stop until reaching the end of the packet.
What if an attacker starts sending packets full of VLAN tags? Since this runs before netfilter, there would be no way to prevent those packets burning our CPU time. And if there are legitimately multiple VLAN tags, they presumably won't all have the 802.1q Ethertype.
Do we need to limit the number of rounds to stop this kind of "bad" packets from burning our CPU time? Then, __netif_receive_skb() has to be update too, so the inspection of tunnel in __skb_get_rxhash() does. Is there a such limitation in xfrm? Thanks. -- Regards, Changli Gao(xiaosuo@gmail.com)