cd005a94ce
it is quite easy to bring down a proxy server by forcing it to make connections to one of its own ports, because this will result in an endless loop spawning more and more connections, until all available fds are exhausted. since there's a potentially infinite number of potential DNS/ip addresses resolving to the proxy, it is impossible to detect an endless loop by simply looking at the destination ip address and port. what *is* possible though is to record the ip/port tuples assigned to outgoing connections, and then compare them against new incoming connections. if they match, the sender was the proxy itself and therefore needs to reject that connection. fixes #199.
12 lines
191 B
C
12 lines
191 B
C
#ifndef LOOP_H
|
|
#define LOOP_H
|
|
|
|
#include "sock.h"
|
|
|
|
void loop_records_init(void);
|
|
void loop_records_add(union sockaddr_union *addr);
|
|
int connection_loops (union sockaddr_union *addr);
|
|
|
|
#endif
|
|
|