[fr0stG]

Quote:

Originally Posted by Kalcor SYN cookies are not normally enabled and it requires kernel level access to enable them. I don't know that most sa-mp servers owners have root access. I've been concerned we'd just be replacing one type of flood for TCP SYN flood. A lot of the attackers aren't using spoofing but have actual botnets to flood with. I could add SYN cookies to UDP, it's just that the end result is the same, just the returned packets are smaller. There are some nice aspects to the fact that you can query a server in a single connectionless packet, especially from SA-MP's point of view when it has to query a whole bunch of servers for the internet/hosted list. We'll see though. I think it's safe to disable the flood protection on the smaller query packets, which would make the attack less effective. But like I said, nothing I add to the server code can magically stop IP spoofing and packet floods.

I believe CentOS 6.x+ started enabling SYN cookies by default. This is a fresh CentOS 7 minimal install and it has it on already:

PHP код:

[root@ce5 sysctl.d]# sysctl net.ipv4.tcp_syncookies
net.ipv4.tcp_syncookies = 1 


Not sure about other distros like Ubuntu, they'll probably have it disabled still.

And yes, you're right, since it's a kernel parameter, you'd need root access to enable it. Even if the user doesn't have root access (e.g non-virtualized KVM/Xen) then they could just ask their host to enable it for them. But the cases where it would not be enabled already is rare. Most hosts would enable SYN cookies by default since shared servers are more likely to be attacked.

I know there's other headaches that come with enabling SYN cookies and using TCP (like tuning the backlog, conntracking, and other junk) but at the end of the day it's still possible to mitigate via a firewall since you've got a legiitmate IP to block instead of spoofed nonsense.

Also another reason why removing the querylimit is a bad idea: like Kalcor stated, it sends traffic to hosts that never requested it. This could allow someone to create a small-scale UDP reflection attack using your SA-MP server. This technique has been used in the past to great effect with DNS amplification/reflection attacks (although DNS responses are MUCH larger than SA-MP server responses)