Re: [PATCH net-next 2/2] flow_dissector: Add limits for encapsulation and EH

2017-09-01 Thread Hannes Frederic Sowa
Tom Herbert writes: > On Fri, Sep 1, 2017 at 9:35 AM, Hannes Frederic Sowa > wrote: >> Hello Tom, >> >> Tom Herbert writes: >> >>> On Fri, Sep 1, 2017 at 6:32 AM, Hannes Frederic Sowa >>> wrote: Tom Herbert writes: > In flow dissector there are no limits to the number of nested

Re: [PATCH net-next 2/2] flow_dissector: Add limits for encapsulation and EH

2017-09-01 Thread Tom Herbert
On Fri, Sep 1, 2017 at 9:35 AM, Hannes Frederic Sowa wrote: > Hello Tom, > > Tom Herbert writes: > >> On Fri, Sep 1, 2017 at 6:32 AM, Hannes Frederic Sowa >> wrote: >>> Tom Herbert writes: >>> In flow dissector there are no limits to the number of nested encapsulations that might be d

Re: [PATCH net-next 2/2] flow_dissector: Add limits for encapsulation and EH

2017-09-01 Thread Hannes Frederic Sowa
Hello Tom, Tom Herbert writes: > On Fri, Sep 1, 2017 at 6:32 AM, Hannes Frederic Sowa > wrote: >> Tom Herbert writes: >> >>> In flow dissector there are no limits to the number of nested >>> encapsulations that might be dissected which makes for a nice DOS >>> attack. This patch limits for dis

Re: [PATCH net-next 2/2] flow_dissector: Add limits for encapsulation and EH

2017-09-01 Thread Tom Herbert
On Fri, Sep 1, 2017 at 6:32 AM, Hannes Frederic Sowa wrote: > Tom Herbert writes: > >> In flow dissector there are no limits to the number of nested >> encapsulations that might be dissected which makes for a nice DOS >> attack. This patch limits for dissecting nested encapsulations >> as well as

Re: [PATCH net-next 2/2] flow_dissector: Add limits for encapsulation and EH

2017-09-01 Thread Hannes Frederic Sowa
Tom Herbert writes: > In flow dissector there are no limits to the number of nested > encapsulations that might be dissected which makes for a nice DOS > attack. This patch limits for dissecting nested encapsulations > as well as for dissecting over extension headers. I was actually more referri

Re: [PATCH net-next 2/2] flow_dissector: Add limits for encapsulation and EH

2017-09-01 Thread Simon Horman
On Thu, Aug 31, 2017 at 03:22:39PM -0700, Tom Herbert wrote: > In flow dissector there are no limits to the number of nested > encapsulations that might be dissected which makes for a nice DOS > attack. This patch limits for dissecting nested encapsulations > as well as for dissecting over extensio

[PATCH net-next 2/2] flow_dissector: Add limits for encapsulation and EH

2017-08-31 Thread Tom Herbert
In flow dissector there are no limits to the number of nested encapsulations that might be dissected which makes for a nice DOS attack. This patch limits for dissecting nested encapsulations as well as for dissecting over extension headers. Reported-by: Hannes Frederic Sowa Signed-off-by: Tom Her