Re: [PATCH v2 net-next 11/11] tcp: rate limit ACK sent by SYN_RECV request sockets

[Neal Cardwell]

On Fri, Apr 1, 2016 at 11:52 AM, Eric Dumazet  wrote:
> Attackers like to use SYNFLOOD targeting one 5-tuple, as they
> hit a single RX queue (and cpu) on the victim.
>
> If they use random sequence numbers in their SYN, we detect
> they do not match the expected window and send back an ACK.
>
> This patch adds a rate limitation, so that the effect of such
> attacks is limited to ingress only.
>
> We roughly double our ability to absorb such attacks.

Thanks, Eric!

Acked-by: Neal Cardwell 

neal

[PATCH v2 net-next 11/11] tcp: rate limit ACK sent by SYN_RECV request sockets

[Eric Dumazet]

Attackers like to use SYNFLOOD targeting one 5-tuple, as they
hit a single RX queue (and cpu) on the victim.

If they use random sequence numbers in their SYN, we detect
they do not match the expected window and send back an ACK.

This patch adds a rate limitation, so that the effect of such
attacks is limited to ingress only.

We roughly double our ability to absorb such attacks.

Signed-off-by: Eric Dumazet 
Cc: Willem de Bruijn 
Cc: Neal Cardwell 
Cc: Maciej Żenczykowski 
---
 net/ipv4/tcp_minisocks.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index acb366dd61e6..4c53e7c86586 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -704,7 +704,10 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff 
*skb,
if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, 
TCP_SKB_CB(skb)->end_seq,
  tcp_rsk(req)->rcv_nxt, 
tcp_rsk(req)->rcv_nxt + req->rsk_rcv_wnd)) {
/* Out of window: send ACK and drop. */
-   if (!(flg & TCP_FLAG_RST))
+   if (!(flg & TCP_FLAG_RST) &&
+   !tcp_oow_rate_limited(sock_net(sk), skb,
+ LINUX_MIB_TCPACKSKIPPEDSYNRECV,
+ &tcp_rsk(req)->last_oow_ack_time))
req->rsk_ops->send_ack(sk, skb, req);
if (paws_reject)
NET_INC_STATS_BH(sock_net(sk), 
LINUX_MIB_PAWSESTABREJECTED);
-- 
2.8.0.rc3.226.g39d4020