On Fri, Jan 13, 2012 at 1:44 PM, Theo de Raadt <[email protected]>wrote:
> From remote I could build a bot-net of machines that send you > illegal fragments and, if you create a state of the bad mappings, you'd > run your state table out. When the state table gets full, it will > eject other stuff which is more important. Like ssh sessions and such. > > We allocate resources (ie. states) to create a mapping of the > 'good sessions'. It is impossible to allocate sufficient resources > to "keep a list of the bad traffic/sessions/guys". > Couldn't you also build a bot-net of machines that send legal fragments? I don't see the difference between a denial-of-service attack that fills up your state table with states that have empty fragment lists, versus a denial-of-service attack that fills up your state table with states that have non-empty fragment lists. To put it another way, an attacker who consumes states by sending overlapping fragments that cause you to retain state (and discard fragments) until the reassembly timeout expires, is no worse than an attacker who consumes states by sending non-overlapping fragments that cause you to retain state (and store fragments) until the reassembly timeout expires. Arguably, the latter case is even worse. -ken
