Re: [Qemu-devel] [PATCH 6/6] vnc: track & limit connections

[Gerd Hoffmann]

  Hi,

> > I try to prevent that by dropping the *oldest* connection, so you have a
> > chance to connect even if a unprivileged attacker tries to use up all
> > connection slots.
> 
> Lets say the limit is 5. The bad guy has 5 open idle connections.
> The good guy opens a new one and pushes off one of the bad guy's
> connections. Fine so far. The bad guy though can simply open 5 more
> connections and he'll push the good guy's connection off again.

Correct.  It can't fully prevent the attack, but makes it harder to pull
off.  Just having $limit idle connects isn't enough any more, the bad
guy has to constantly bomb qemu with vnc connect requests, hoping this
kicks out the good guy before it managed to authenticate.  The chances
for the good guy are a bit better and it is also more likely that the
attack sets off alarms in network monitoring.

cheers,
  Gerd