Subject: Re: Hashing IP reassembly queues, phase 2 of 2: fragmeDoS
To: Jonathan Stone <jonathan@DSG.Stanford.EDU>
From: Jason Thorpe <thorpej@wasabisystems.com>
List: tech-net
Date: 12/13/2003 15:01:15
--Apple-Mail-19-707478881
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII; format=flowed


On Dec 13, 2003, at 2:53 PM, Jonathan Stone wrote:

> Roger that on the initialization and sysctl. I dont grok Andrew's new
> sysctl machinery well enough to just drop in a sysctl hook, let alone
> a sysctl hook that would auto-recompute ip_maxfrags when nmbclusters
> is changed via sysctl. (Which has pros and cons of its own:
> least-suprise cuts both ways on that one).

Here's what I'd do...

Cache the value of nmbclusters used to compute ip_maxfrags 
(ip_maxfrags_nmbclusters, call it), and then do:

	if (__predict_false(ip_maxfrags_nmbclusters != nmbclusters)) {
		ip_maxfrags_nmbclusters = nmbclusters;
		ip_maxfrags = ip_maxfrags_nmbclusters / 4;
	}

...no sysctl magic needed.

         -- Jason R. Thorpe <thorpej@wasabisystems.com>


--Apple-Mail-19-707478881
content-type: application/pgp-signature; x-mac-type=70674453;
	name=PGP.sig
content-description: This is a digitally signed message part
content-disposition: inline; filename=PGP.sig
content-transfer-encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (Darwin)

iD8DBQE/25o8OpVKkaBm8XkRAk2dAKCjrzqlDeORrUWzAc9GOxi1pYK4sACfQjvc
HY91TDCVBWJQ87DaNEITj1w=
=Pui4
-----END PGP SIGNATURE-----

--Apple-Mail-19-707478881--