Re: speaking of DoS, openssh and dropbear (CVE-2006-1206)

[Solar Designer <solar () openwall com>]

Hi,

One of the ideas I have is to make the per-source limit(s) dynamic -
based on the remaining number of free slots (for a given category, if
applicable - e.g., with per-netblock limits).

The attached Perl script simulates a worst-case scenario for an
algorithm implementing this.  Specifically, with 1000 slots and
allocations starting at 10 slots per source (and reducing all the way to
1 per source as we're about to run out of free slots), we're able to
accept connections from at least 292 different source addresses.
With 1000 slots, but starting at 50 slots per source, we're able to
accept connections from at least 88 different source addresses.

$ ./persource.pl | wc -l
292
$ for n in {10..1}; do ./persource.pl | fgrep -cx $n; done
10
12
12
14
17
20
24
34
49
100

Alexander

Attachment: persource.pl
Description: