netdev - Re: [PATCH] net: set default value for somaxconn

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 May 2017 14:18:09 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     roman.kapl@...go.com
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH] net: set default value for somaxconn

From: Roman Kapl <roman.kapl@...go.com>
Date: Mon, 22 May 2017 14:22:41 +0200

> The default value for somaxconn is set in sysctl_core_net_init(), but this
> function is not called when kernel is configured without CONFIG_SYSCTL.
> 
> This results in the kernel not being able to accept TCP connections,
> because the backlog has zero size. Usually, the user ends up with:
> "TCP: request_sock_TCP: Possible SYN flooding on port 7. Dropping request.  Check SNMP counters."
> 
> Before ef547f2ac16 (tcp: remove max_qlen_log), the effects were less
> severe, because the backlog was always at least eight slots long.
> 
> Signed-off-by: Roman Kapl <roman.kapl@...go.com>

I see the problem, but this changes behavior.

Existing code will set somaxconn to the default value for every namespace
that is created.

But with you changes, any modification made to init_net's value will
get inherited by any namespace created as a child thereafterwards.

You really need to make this happen via pernet_operations, or even
inside of setup_net().