Re: [PATCH 2/4] net-next: ip6: fetch inetpeer in ip6frag_init
From: Richard Gobert <hidden>
Date: 2022-09-01 14:51:03
Also in:
linux-doc, lkml, netfilter-devel
From: Richard Gobert <hidden>
Date: 2022-09-01 14:51:03
Also in:
linux-doc, lkml, netfilter-devel
On Mon, Aug 29, 2022 at 03:20:54PM -0700, Eric Dumazet wrote:
Sorry, this is adding yet another bottleneck, and will make DDOS attacks based on fragments more effective. Whole concept of 'peers' based on IPv6 addresses is rather weak, as hosts with IPv6 can easily get millions of different 'addresses'.
I understand the problem with the implementation. Since peers don't carry much weight in IPv6, this patch can be dropped.