netdev - Re: [PATCH net-next 1/2] tcp: call tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 28 Jul 2018 09:28:52 -0700
From:   Eric Dumazet <edumazet@...gle.com>
To:     Yafang Shao <laoar.shao@...il.com>
Cc:     David Miller <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH net-next 1/2] tcp: call tcp_drop() in tcp collapse

On Sat, Jul 28, 2018 at 12:43 AM Yafang Shao <laoar.shao@...il.com> wrote:
>
> On Sat, Jul 28, 2018 at 11:38 AM, Eric Dumazet <edumazet@...gle.com> wrote:
> > On Fri, Jul 27, 2018 at 8:35 PM Yafang Shao <laoar.shao@...il.com> wrote:
> >
> >> So what about LINUX_MIB_TCPOFOMERGE ?
> >> Regarding LINUX_MIB_TCPOFOMERGE,  a skb is already covered by another
> >> skb, is that dropping the packet or simply lowering the memory
> >> overhead ?
> >
> > What do you think ?
> >
> > If you receive two times the same payload, don't you have to drop one
> > of the duplicate ?
> >
> > There is a a big difference between the two cases.
>
> If the drop caused some data lost (which may then cause retransmition
> or something), then this is a really DROP.
> While if the drop won't cause any data lost, meaning it is a
> non-harmful behavior, I think it should not be defined as DROP.
> This is my suggestion anyway.

Sigh.

We count drops, not because they are ' bad or something went wrong'.

If TCP stack receives twice the same sequence (same payload), we
_drop_ one of the duplicate, so we account for this event.

When ' collapsing'  we reorganize our own storage, not because we have
to drop a payload,
but for some memory pressure reason.
We have specific SNMP counters to account for these, we do not want to
pretend a packet was ' dropped' since it was not.

If we have to _drop_ some packets, it is called Pruning, and we do
properly account for these drops.