netdev - Re: [net-next-2.6 PATCH v7 2/7 RFC] TCPCT part 1b: generate Responder Cookie secret

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4B0810C4.1060004@gmail.com>
Date:	Sat, 21 Nov 2009 11:09:40 -0500
From:	William Allen Simpson <william.allen.simpson@...il.com>
To:	David Miller <davem@...emloft.net>
CC:	andi@...stfloor.org, netdev@...r.kernel.org,
	Eric Dumazet <eric.dumazet@...il.com>
Subject: Re: [net-next-2.6 PATCH v7 2/7 RFC] TCPCT part 1b: generate Responder
 Cookie secret

David Miller wrote:
> From: Andi Kleen <andi@...stfloor.org>
> Date: Fri, 20 Nov 2009 21:47:17 +0100
> 
>> David Miller <davem@...emloft.net> writes:
>>
>>> From: William Allen Simpson <william.allen.simpson@...il.com>
>>> Date: Fri, 20 Nov 2009 09:23:21 -0500
>>>
>>>> +static DEFINE_SPINLOCK(tcp_secret_locker);
>>> So connection creation scalability will be limited now because
>>> we'll always have to go through this centralized spinlock even
>>> for independent listening sockets, right?
>> I was about to complain about the same thing in a earlier version
>> of this patch kit, but then I noticed the spin lock aquiring 
>> is guarded by
>>
>> if (unlikely(time_after_eq(jiffy, tcp_secret_generating->expires))) {
>>
>> which presumably makes it rare enough?
> 
> Works for me.
> 
Roughly once every 10 minutes.  In the original code with rw_lock()
that would have been more frequent on the read side, but the RCU
technique speeds that up considerably?

Also, not every listening socket, just sockets after a cookie option
arrives.  That will probably be only a few selected sockets, at least
for the time being.


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html