From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Paasch Subject: Re: [PATCH net-next 2/5] tcp: TFO: search for correct cookie and accept data Date: Mon, 17 Dec 2018 14:59:42 -0800 Message-ID: <20181217225942.GB41383@MacBook-Pro-19.local> References: <20181214224007.54813-1-cpaasch@apple.com> <20181214224007.54813-3-cpaasch@apple.com> <80ac109a-6e97-e24b-beea-37c047be4f55@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; CHARSET=US-ASCII Content-Transfer-Encoding: 7BIT Cc: netdev@vger.kernel.org, Eric Dumazet , Yuchung Cheng , David Miller To: Eric Dumazet Return-path: Received: from ma1-aaemail-dr-lapp03.apple.com ([17.171.2.72]:32926 "EHLO ma1-aaemail-dr-lapp03.apple.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727655AbeLQW7v (ORCPT ); Mon, 17 Dec 2018 17:59:51 -0500 Content-disposition: inline In-reply-to: <80ac109a-6e97-e24b-beea-37c047be4f55@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: On 16/12/18 - 22:30:51, Eric Dumazet wrote: > > > On 12/14/2018 02:40 PM, Christoph Paasch wrote: > > This change allows to search for the right cookie and accepts old ones > > (announcing a new one if it has changed). > > > > __tcp_fastopen_cookie_gen_with_ctx() allows to generate a cookie based > > on a given TFO-context. A later patch will cleanup the duplicate code. > > How long is kept the secondary (old) context ? There is no time-limit on keeping the older context. In an older version of this series I had the pool-size as a sysctl so one could try out different configurations. For us, a size of 2 was good enough. I could bring that back if you think it's useful. > I do not know exact crypto_cipher_encrypt_one() cost, but it looks like > your patch could double the cost of some TFO based attacks ? True, we are doing more crypto if we are getting a lot of invalid or old cookies. I don't have a good answer to that besides that one should probably disable TFO at that point ;-) On the other hand, AFAICS tcp_conn_request will end up setting want_cookie to true under SYN-flooding so we won't even enter tcp_try_fastopen if it's really an attack. Christoph