netdev - Re: [PATH net-next] tcp: pause Fast Open globally after third consecutive timeout

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20171213.155138.401295393122455021.davem@davemloft.net>
Date:   Wed, 13 Dec 2017 15:51:38 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     ycheng@...gle.com
Cc:     netdev@...r.kernel.org, edumazet@...gle.com, ncardwell@...gle.com,
        weiwan@...gle.com, cpaasch@...le.com, ddamjanovic@...illa.com,
        mcmanus@...ksong.com
Subject: Re: [PATH net-next] tcp: pause Fast Open globally after third
 consecutive timeout

From: Yuchung Cheng <ycheng@...gle.com>
Date: Tue, 12 Dec 2017 13:10:40 -0800

> Prior to this patch, active Fast Open is paused on a specific
> destination IP address if the previous connections to the
> IP address have experienced recurring timeouts . But recent
> experiments by Microsoft (https://goo.gl/cykmn7) and Mozilla
> browsers indicate the isssue is often caused by broken middle-boxes
> sitting close to the client. Therefore it is much better user
> experience if Fast Open is disabled out-right globally to avoid
> experiencing further timeouts on connections toward other
> destinations.
> 
> This patch changes the destination-IP disablement to global
> disablement if a connection experiencing recurring timeouts
> or aborts due to timeout.  Repeated incidents would still
> exponentially increase the pause time, starting from an hour.
> This is extremely conservative but an unfortunate compromise to
> minimize bad experience due to broken middle-boxes.
> 
> Reported-by: Dragana Damjanovic <ddamjanovic@...illa.com>
> Reported-by: Patrick McManus <mcmanus@...ksong.com>
> Signed-off-by: Yuchung Cheng <ycheng@...gle.com>
> Reviewed-by: Wei Wang <weiwan@...gle.com>
> Reviewed-by: Neal Cardwell <ncardwell@...gle.com>
> Reviewed-by: Eric Dumazet <edumazet@...gle.com>

Very unfortunate, but I can't suggest anything better at this time.

Applied, thank you.