[PATCH] tcp.7: tcp_syncookies: It is now an integer [0, 2]

[PATCH] tcp.7: tcp_syncookies: It is now an integer [0, 2]

[Alejandro Colomar]

Since Linux kernel 3.12, tcp_syncookies can have the value 2,
which sends out cookies unconditionally.

Related kernel commits:
5ad37d5deee1ff7150a2d0602370101de158ad86
d8513df2598e5142f8a5c4724f28411936e1dfc7

Reported-by: Philip Rowlands <linux-kernel@dimebar.com>
Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: David S. Miller <davem@davemloft.net>
---
 man7/tcp.7 | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/man7/tcp.7 b/man7/tcp.7
index d983a8f9a..591f73d8d 100644
--- a/man7/tcp.7
+++ b/man7/tcp.7
@@ -830,12 +830,11 @@ The maximum number of times a SYN/ACK segment
 for a passive TCP connection will be retransmitted.
 This number should not be higher than 255.
 .TP
-.IR tcp_syncookies " (Boolean; since Linux 2.2)"
+.IR tcp_syncookies " (integer; default: 1; since Linux 2.2)"
 .\" Since 2.1.43
 Enable TCP syncookies.
 The kernel must be compiled with
 .BR CONFIG_SYN_COOKIES .
-Send out syncookies when the syn backlog queue of a socket overflows.
 The syncookies feature attempts to protect a
 socket from a SYN flood attack.
 This should be used as a last resort, if at all.
@@ -849,6 +848,17 @@ For recommended alternatives see
 .IR tcp_synack_retries ,
 and
 .IR tcp_abort_on_overflow .
+Set to one of the following values:
+.RS
+.IP 0 3
+Disable TCP syncookies.
+.IP 1
+Send out syncookies when the syn backlog queue of a socket overflows.
+.IP 2
+.\" commit 5ad37d5deee1ff7150a2d0602370101de158ad86
+Send out syncookies unconditionally.
+This can be useful for network testing.
+.RE
 .TP
 .IR tcp_timestamps " (integer; default: 1; since Linux 2.2)"
 .\" Since 2.1.36
-- 
2.29.2

Re: [PATCH] tcp.7: tcp_syncookies: It is now an integer [0, 2]

[Michael Kerrisk (man-pages)]

Hi Alex,


On 12/7/20 6:08 PM, Alejandro Colomar wrote:
> Since Linux kernel 3.12, tcp_syncookies can have the value 2,
> which sends out cookies unconditionally.
> 
> Related kernel commits:
> 5ad37d5deee1ff7150a2d0602370101de158ad86
> d8513df2598e5142f8a5c4724f28411936e1dfc7
> 
> Reported-by: Philip Rowlands <linux-kernel@dimebar.com>
> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
> Cc: Eric Dumazet <eric.dumazet@gmail.com>
> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
> Cc: David S. Miller <davem@davemloft.net>
> ---
>  man7/tcp.7 | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/man7/tcp.7 b/man7/tcp.7
> index d983a8f9a..591f73d8d 100644
> --- a/man7/tcp.7
> +++ b/man7/tcp.7
> @@ -830,12 +830,11 @@ The maximum number of times a SYN/ACK segment
>  for a passive TCP connection will be retransmitted.
>  This number should not be higher than 255.
>  .TP
> -.IR tcp_syncookies " (Boolean; since Linux 2.2)"
> +.IR tcp_syncookies " (integer; default: 1; since Linux 2.2)"
>  .\" Since 2.1.43
>  Enable TCP syncookies.
>  The kernel must be compiled with
>  .BR CONFIG_SYN_COOKIES .
> -Send out syncookies when the syn backlog queue of a socket overflows.
>  The syncookies feature attempts to protect a
>  socket from a SYN flood attack.
>  This should be used as a last resort, if at all.
> @@ -849,6 +848,17 @@ For recommended alternatives see
>  .IR tcp_synack_retries ,
>  and
>  .IR tcp_abort_on_overflow .
> +Set to one of the following values:
> +.RS
> +.IP 0 3
> +Disable TCP syncookies.
> +.IP 1
> +Send out syncookies when the syn backlog queue of a socket overflows.
> +.IP 2

I think it's helpful to let the reader know that this is a more
recent feature. So, better:

.IP 2 (since Linux 3.12)

Thanks,

Michael

> +.\" commit 5ad37d5deee1ff7150a2d0602370101de158ad86
> +Send out syncookies unconditionally.
> +This can be useful for network testing.
> +.RE
>  .TP
>  .IR tcp_timestamps " (integer; default: 1; since Linux 2.2)"
>  .\" Since 2.1.36
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Re: [PATCH] tcp.7: tcp_syncookies: It is now an integer [0, 2]

[Alejandro Colomar (man-pages)]

Hi Michael,

On 12/11/20 9:32 AM, Michael Kerrisk (man-pages) wrote:[...]
>> +.IP 2
> 
> I think it's helpful to let the reader know that this is a more
> recent feature. So, better:
> 
> .IP 2 (since Linux 3.12)

Sure!

Thanks,

Alex

> 
> Thanks,
> 
> Michael
> 
>> +.\" commit 5ad37d5deee1ff7150a2d0602370101de158ad86
>> +Send out syncookies unconditionally.
>> +This can be useful for network testing.
>> +.RE
>>  .TP
>>  .IR tcp_timestamps " (integer; default: 1; since Linux 2.2)"
>>  .\" Since 2.1.36
>>
> 
> 

-- 
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es

[PATCH v2] tcp.7: tcp_syncookies: It is now an integer [0, 2]

[Alejandro Colomar]

Since Linux kernel 3.12, tcp_syncookies can have the value 2,
which sends out cookies unconditionally.

Related kernel commits:
5ad37d5deee1ff7150a2d0602370101de158ad86
d8513df2598e5142f8a5c4724f28411936e1dfc7

Reported-by: Philip Rowlands <linux-kernel@dimebar.com>
Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: David S. Miller <davem@davemloft.net>
---
 man7/tcp.7 | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/man7/tcp.7 b/man7/tcp.7
index d983a8f9a..cce8dd910 100644
--- a/man7/tcp.7
+++ b/man7/tcp.7
@@ -830,12 +830,11 @@ The maximum number of times a SYN/ACK segment
 for a passive TCP connection will be retransmitted.
 This number should not be higher than 255.
 .TP
-.IR tcp_syncookies " (Boolean; since Linux 2.2)"
+.IR tcp_syncookies " (integer; default: 1; since Linux 2.2)"
 .\" Since 2.1.43
 Enable TCP syncookies.
 The kernel must be compiled with
 .BR CONFIG_SYN_COOKIES .
-Send out syncookies when the syn backlog queue of a socket overflows.
 The syncookies feature attempts to protect a
 socket from a SYN flood attack.
 This should be used as a last resort, if at all.
@@ -849,6 +848,18 @@ For recommended alternatives see
 .IR tcp_synack_retries ,
 and
 .IR tcp_abort_on_overflow .
+Set to one of the following values:
+.RS
+.IP 0 3
+Disable TCP syncookies.
+.IP 1
+Send out syncookies when the syn backlog queue of a socket overflows.
+.IP 2
+(since Linux 3.12)
+.\" commit 5ad37d5deee1ff7150a2d0602370101de158ad86
+Send out syncookies unconditionally.
+This can be useful for network testing.
+.RE
 .TP
 .IR tcp_timestamps " (integer; default: 1; since Linux 2.2)"
 .\" Since 2.1.36
-- 
2.29.2

Re: [PATCH v2] tcp.7: tcp_syncookies: It is now an integer [0, 2]

[Michael Kerrisk (man-pages)]

Hi Alex,

On 12/11/20 7:47 PM, Alejandro Colomar wrote:
> Since Linux kernel 3.12, tcp_syncookies can have the value 2,
> which sends out cookies unconditionally.

Thanks. Patch applied.

Cheers,

Michael

> Related kernel commits:
> 5ad37d5deee1ff7150a2d0602370101de158ad86
> d8513df2598e5142f8a5c4724f28411936e1dfc7
> 
> Reported-by: Philip Rowlands <linux-kernel@dimebar.com>
> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
> Cc: Eric Dumazet <eric.dumazet@gmail.com>
> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
> Cc: David S. Miller <davem@davemloft.net>
> ---
>  man7/tcp.7 | 15 +++++++++++++--
>  1 file changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/man7/tcp.7 b/man7/tcp.7
> index d983a8f9a..cce8dd910 100644
> --- a/man7/tcp.7
> +++ b/man7/tcp.7
> @@ -830,12 +830,11 @@ The maximum number of times a SYN/ACK segment
>  for a passive TCP connection will be retransmitted.
>  This number should not be higher than 255.
>  .TP
> -.IR tcp_syncookies " (Boolean; since Linux 2.2)"
> +.IR tcp_syncookies " (integer; default: 1; since Linux 2.2)"
>  .\" Since 2.1.43
>  Enable TCP syncookies.
>  The kernel must be compiled with
>  .BR CONFIG_SYN_COOKIES .
> -Send out syncookies when the syn backlog queue of a socket overflows.
>  The syncookies feature attempts to protect a
>  socket from a SYN flood attack.
>  This should be used as a last resort, if at all.
> @@ -849,6 +848,18 @@ For recommended alternatives see
>  .IR tcp_synack_retries ,
>  and
>  .IR tcp_abort_on_overflow .
> +Set to one of the following values:
> +.RS
> +.IP 0 3
> +Disable TCP syncookies.
> +.IP 1
> +Send out syncookies when the syn backlog queue of a socket overflows.
> +.IP 2
> +(since Linux 3.12)
> +.\" commit 5ad37d5deee1ff7150a2d0602370101de158ad86
> +Send out syncookies unconditionally.
> +This can be useful for network testing.
> +.RE
>  .TP
>  .IR tcp_timestamps " (integer; default: 1; since Linux 2.2)"
>  .\" Since 2.1.36
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/