<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I don't see how how the ip-ratelimit feature in unbound would need
to be protocol aware considering that is it is restrained to the
unbound daemon and its ports and not being in charge of the entire
network?<br>
<div class="moz-signature"><br>
</div>
<div class="moz-cite-prefix">On 28.11.2018 19:08, Paul Vixie via
Unbound-users wrote:<br>
</div>
<blockquote type="cite" cite="mid:5BFED984.70904@redbarn.org">
<br>
<br>
Maciej Gawron via Unbound-users wrote:
<br>
<blockquote type="cite">Hi,
<br>
I think global IP-ratelimit will fit nicely.
<br>
</blockquote>
<br>
i disagree, since the source ip addresses are nonrepudiable. a
non-protocol-aware rate limiter is an easy ddos vector since an
attacker can use up all available credits for some victim simply
by forging that victim's ip address on an otherwise normal looking
flow.
<br>
<br>
see: <a class="moz-txt-link-freetext" href="https://www.icann.org/en/system/files/files/sac-004-en.pdf">https://www.icann.org/en/system/files/files/sac-004-en.pdf</a>
<br>
<br>
also: <a class="moz-txt-link-freetext" href="https://queue.acm.org/detail.cfm?id=2578510">https://queue.acm.org/detail.cfm?id=2578510</a>
<br>
<br>
transaction or session limits will be nec'y; packet limits are
wrong where udp is concerned.
<br>
<br>
</blockquote>
<br>
</body>
</html>