netdev - Re: Modifying the exponential backoff on new connection SYN packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1365515283.3887.124.camel@edumazet-glaptop>
Date:	Tue, 09 Apr 2013 06:48:03 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Ed W <lists@...dgooses.com>
Cc:	Linux Networking Developer Mailing List <netdev@...r.kernel.org>
Subject: Re: Modifying the exponential backoff on new connection SYN packets

On Tue, 2013-04-09 at 10:06 +0100, Ed W wrote:
> Hi, I have an unusual situation in that I would like to cap the 
> retransmit frequency on the initial SYN packets at some fairly short 
> time interval, eg a max of 2-4 seconds, rather than the usual 
> exponentially increasing interval.  I could use some help figuring out 
> the exact point in the kernel to make such a change please?
> 
> The situation is that I am building a firewall which will be used with 
> expensive satellite links (think $10-100/MB range). Some of the links 
> are dialup links which take 20-40 seconds to bring up, and then we have 
> PPP drop the link after 10 seconds of inactivity. However, with the 
> default exponential backoff on new connections we are generally 
> retransmitting with a 16sec or 32 sec interval by the time the dialup 
> link is connected, the timout for inactivity kicks in and drops the link 
> before the retransmit...
> 
> I believe the exponential backoff is intended to prevent amplification 
> attacks? In this particular case we are accounting for traffic per user 
> and the internet costs are extremely substantial, so I think it's not a 
> problem
> 
> Could someone please help figure out the appropriate place to tweak the 
> exponential backoff? Note this is not retransmit of in flight data, just 
> the backoff for the initial syn (which doesn't seem to be configurable 
> in user space?)
> 
> Note, we have an application proxy here, but I can't see a sensible way 
> to fake it in user space without a lot of extra coding - any suggestions?

You'll have to change inet_csk_reqsk_queue_prune() in
net/ipv4/inet_connection_sock.c

timeo = min(timeout << req->num_timeout, max_rto);
req->expires = now + timeo; 

Good luck !

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html