summaryrefslogtreecommitdiffstats
path: root/lib/libalias
diff options
context:
space:
mode:
authorru <ru@FreeBSD.org>2000-04-14 15:34:55 +0000
committerru <ru@FreeBSD.org>2000-04-14 15:34:55 +0000
commit314acb2e389207fd9a6bcb0d71a9d227ed10b32b (patch)
tree90f2bb7416cdfebf78ee7b745d61b011f30fc83b /lib/libalias
parent51c489181319e1c5698f1b9117da76a11b62f3f5 (diff)
downloadFreeBSD-src-314acb2e389207fd9a6bcb0d71a9d227ed10b32b.zip
FreeBSD-src-314acb2e389207fd9a6bcb0d71a9d227ed10b32b.tar.gz
Apply TCP_EXPIRE_CONNECTED (86400 seconds) timeout only to established
connections, after SYN packets were seen from both ends. Before this, it would get applied right after the first SYN packet was seen (either from client or server). With broken TCP connection attempts, when the remote end does not respond with SYNACK nor with RST, this resulted in having a useless (ie, no actual TCP connection associated with it) TCP link with 86400 seconds TTL, wasting system memory. With high rate of such broken connection attempts (for example, remote end simply blocks these connection attempts with ipfw(8) without sending RST back), this could result in a denial-of-service. PR: bin/17963
Diffstat (limited to 'lib/libalias')
-rw-r--r--lib/libalias/alias_db.c26
1 files changed, 10 insertions, 16 deletions
diff --git a/lib/libalias/alias_db.c b/lib/libalias/alias_db.c
index 86223cd..1ea3413 100644
--- a/lib/libalias/alias_db.c
+++ b/lib/libalias/alias_db.c
@@ -1544,22 +1544,19 @@ SetStateIn(struct alias_link *link, int state)
/* TCP input state */
switch (state) {
case ALIAS_TCP_STATE_DISCONNECTED:
- if (link->data.tcp->state.out != ALIAS_TCP_STATE_CONNECTED) {
+ if (link->data.tcp->state.out != ALIAS_TCP_STATE_CONNECTED)
link->expire_time = TCP_EXPIRE_DEAD;
- } else {
+ else
link->expire_time = TCP_EXPIRE_SINGLEDEAD;
- }
- link->data.tcp->state.in = state;
break;
case ALIAS_TCP_STATE_CONNECTED:
- link->expire_time = TCP_EXPIRE_CONNECTED;
- /*FALLTHROUGH*/
- case ALIAS_TCP_STATE_NOT_CONNECTED:
- link->data.tcp->state.in = state;
+ if (link->data.tcp->state.out == ALIAS_TCP_STATE_CONNECTED)
+ link->expire_time = TCP_EXPIRE_CONNECTED;
break;
default:
abort();
}
+ link->data.tcp->state.in = state;
}
@@ -1569,22 +1566,19 @@ SetStateOut(struct alias_link *link, int state)
/* TCP output state */
switch (state) {
case ALIAS_TCP_STATE_DISCONNECTED:
- if (link->data.tcp->state.in != ALIAS_TCP_STATE_CONNECTED) {
+ if (link->data.tcp->state.in != ALIAS_TCP_STATE_CONNECTED)
link->expire_time = TCP_EXPIRE_DEAD;
- } else {
+ else
link->expire_time = TCP_EXPIRE_SINGLEDEAD;
- }
- link->data.tcp->state.out = state;
break;
case ALIAS_TCP_STATE_CONNECTED:
- link->expire_time = TCP_EXPIRE_CONNECTED;
- /*FALLTHROUGH*/
- case ALIAS_TCP_STATE_NOT_CONNECTED:
- link->data.tcp->state.out = state;
+ if (link->data.tcp->state.in == ALIAS_TCP_STATE_CONNECTED)
+ link->expire_time = TCP_EXPIRE_CONNECTED;
break;
default:
abort();
}
+ link->data.tcp->state.out = state;
}
OpenPOWER on IntegriCloud