Re: Enable syn cookies by default

[Florian Westphal <fw@strlen.de>]

Jarek Poplawski <jarkao2@gmail.com> wrote:
> > On 15-10-2009 10:59, Olaf van der Spek wrote:
> >> On Sat, Oct 10, 2009 at 3:01 PM, Olaf van der Spek <olafvdspek@gmail.com> wrote:
> >>> Hi,
> >>>
> >>> I'm forwarding Debian feature request #520668.
> >>>
> >>> Could syn cookies be enabled by default?
> > 
> > Hi,
> > 
> > Alas, I can only give you a hint: while waiting for a better response,
> > you could try to 'google' for some archives of this list; AFAICR a few
> > (?) months ago David Miller explained this first question at least.
> > (In short: they aren't up-to-date enough.)
> 
> It looks like my memory is exact only about dates ("?"! ;-). There was
> mainly David's opinion and some more in the thread (shared with lkml).
> Here is a link:
> http://lkml.indiana.edu/hypermail/linux/kernel/0807.3/0050.html

Hrm, strange.

The syncookie sysctl only has an effect on tcp options
once a listening sockets' syn queue is full. And even if you lose all
the tcp options -- without tcp_syncookies=1, the connection request
would have been discarded. So I do not really understand why they
shouldn't default to 1. I've sent patches for both points raised
(no warning about syn queue overflow if cookies are disabled,
 syncookies sysctl defaults to 0), lets see what happens :-)