netdev - [PATCH 0/3] Namespaceify tcp keepalive machinery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu,  7 Jan 2016 16:38:42 +0200
From:	Nikolay Borisov <kernel@...p.com>
To:	davem@...emloft.net, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc:	edumazet@...gle.com, ebiederm@...ssion.com, fan.du@...el.com,
	kaber@...sh.net, jmorris@...ei.org, alexander.h.duyck@...hat.com,
	kuznet@....inr.ac.ru, operations@...eground.com
Subject: [PATCH 0/3] Namespaceify tcp keepalive machinery

The following patch series enables the tcp keepalive mechanism
to be configured per net namespace. This is especially useful
if you have multiple containers hosted on one node and one of 
them is under DoS-  in such situations one thing which could 
be done is to configure the tcp keepalive settings such that 
connections for that particular container are being reset 
faster.

Another scenario where not being able to control those knob
comes per container is problematic is occurs the value of 
net.netfilter.nf_conntrack_tcp_timeout_established is set
below the keepalive interval, in such situations the server won't 
send an RST packet resulting in applications not trying to 
reconnect and stale connection waiting. Changing the global 
keepalive value is a possible solution but it might interfere
with other containers. 

The three patches gradually convert each of the affected knobs
to be per netns. I thought it would be easier for review than 
put everything in one patch. If people deem it more appropriate 
to squash everything in one patch (maybe after review) I'd
be more than happy to do it. 

The patches have been compile-tested on 4.4 and functionally 
tested on 3.12 and they work as expected. 

These are based off 4.4-rc8

Nikolay Borisov (3):
  ipv4: Namespaceify tcp_keepalive_time sysctl knob
  ipv4: Namespecify tcp_keepalive_probes sysctl knob 
  ipv4: Namespecify the tcp_keepalive_intvl sysctl knob

 include/net/netns/ipv4.h   |  4 ++++
 include/net/tcp.h          | 15 +++++++++------
 net/ipv4/sysctl_net_ipv4.c | 42 +++++++++++++++++++++---------------------
 net/ipv4/tcp_ipv4.c        |  4 ++++
 net/ipv4/tcp_timer.c       |  3 ---
 5 files changed, 38 insertions(+), 30 deletions(-)

-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html