Neal Cardwell
032ee42369
tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks ...
Helpers for mitigating ACK loops by rate-limiting dupacks sent in
response to incoming out-of-window packets.
This patch includes:
- rate-limiting logic
- sysctl to control how often we allow dupacks to out-of-window packets
- SNMP counter for cases where we rate-limited our dupack sending
The rate-limiting logic in this patch decides to not send dupacks in
response to out-of-window segments if (a) they are SYNs or pure ACKs
and (b) the remote endpoint is sending them faster than the configured
rate limit.
We rate-limit our responses rather than blocking them entirely or
resetting the connection, because legitimate connections can rely on
dupacks in response to some out-of-window segments. For example, zero
window probes are typically sent with a sequence number that is below
the current window, and ZWPs thus expect to thus elicit a dupack in
response.
We allow dupacks in response to TCP segments with data, because these
may be spurious retransmissions for which the remote endpoint wants to
receive DSACKs. This is safe because segments with data can't
realistically be part of ACK loops, which by their nature consist of
each side sending pure/data-less ACKs to each other.
The dupack interval is controlled by a new sysctl knob,
tcp_invalid_ratelimit, given in milliseconds, in case an administrator
needs to dial this upward in the face of a high-rate DoS attack. The
name and units are chosen to be analogous to the existing analogous
knob for ICMP, icmp_ratelimit.
The default value for tcp_invalid_ratelimit is 500ms, which allows at
most one such dupack per 500ms. This is chosen to be 2x faster than
the 1-second minimum RTO interval allowed by RFC 6298 (section 2, rule
2.4). We allow the extra 2x factor because network delay variations
can cause packets sent at 1 second intervals to be compressed and
arrive much closer.
Reported-by: Avery Fay <avery@mixpanel.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-08 01:03:12 -08:00
net/9p: remove a comment about pref member which doesn't exist
2014-11-06 14:59:19 -05:00
Bluetooth: Remove mgmt_rp_read_local_oob_ext_data struct
2015-02-02 18:27:56 +01:00
irda: Convert function pointer arrays and uses to const
2014-12-10 15:33:16 -05:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-02-05 14:33:28 -08:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-02-05 14:33:28 -08:00
NFC: nci: Move logical connection structure allocation
2015-02-04 09:14:09 +01:00
switch sctp_user_addto_chunk() and sctp_datamsg_from_user() to passing iov_iter
2014-11-24 05:16:40 -05:00
net: sched: Introduce connmark action
2015-01-19 16:02:06 -05:00
ieee802154: 6lowpan: rename process_data and lowpan_process_data
2014-10-27 15:51:16 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-09-23 12:09:27 -04:00
ieee802154: mac802154: remove FSF address
2014-10-25 08:07:30 +02:00
vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr
2014-11-24 05:16:42 -05:00
ipsec: Remove obsolete MAX_AH_AUTH_LEN
2014-09-18 10:54:36 +02:00
bonding: cleanup and remove dead code
2015-01-27 17:09:04 -08:00
net: Move bonding headers under include/net
2014-11-10 13:27:49 -05:00
net: Move bonding headers under include/net
2014-11-10 13:27:49 -05:00
net/bonding: Notify state change on slaves
2015-02-04 16:14:24 -08:00
nl80211: add an attribute to allow delaying the first scheduled scan cycle
2015-01-23 10:30:47 +01:00
nl802154: introduce support for cca settings
2014-12-19 00:19:23 +01:00
net: Add remcsum_adjust as common function for remote checksum offload
2014-11-26 12:25:43 -05:00
net: use ktime_get_ns() and ktime_get_real_ns() helpers
2014-08-22 19:57:23 -07:00
fold verify_iovec() into copy_msghdr_from_user()
2014-11-19 16:23:49 -05:00
Update setapp/getapp prototypes in dcbnl_rtnl_ops to return int instead of u8
2014-07-17 16:02:29 -07:00
net: dsa: Add support for reading switch registers with ethtool
2014-10-30 14:54:11 -04:00
xfrm: Generate queueing routes only from route lookup functions
2014-09-16 10:08:49 +02:00
percpu_counter: add @gfp to percpu_counter_init()
2014-09-08 09:51:29 +09:00
ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif
2014-04-16 15:05:11 -04:00
flow_keys: n_proto type should be __be16
2015-02-05 00:40:22 -08:00
ip_tunnel: Ops registration for secondary encap (fou, gue)
2014-11-12 15:01:35 -05:00
net: sched: enable per cpu qstats
2014-09-30 01:02:26 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-01-27 16:59:56 -08:00
openvswitch: Add support for checksums on UDP tunnels.
2015-01-28 23:04:15 -08:00
gre: Call gso_make_checksum
2014-06-04 22:46:38 -07:00
ip_tunnel: Create percpu gro_cell
2015-01-18 01:56:32 -05:00
gue: Protocol constants for remote checksum offload
2014-11-05 16:30:03 -05:00
ieee802154: rework cca setting
2014-12-19 00:19:23 +01:00
ipv6: remove aca_lock spinlock from struct ifacaddr6
2014-10-14 13:15:15 -04:00
ipv4: add a sock pointer to ip_queue_xmit()
2014-04-15 12:58:34 -04:00
ipv6: move INET6_MATCH() to include/net/inet6_hashtables.h
2014-11-05 16:59:04 -05:00
net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks
2014-11-26 15:45:04 -05:00
net: tcp: add key management to congestion control
2015-01-05 22:55:24 -05:00
tunnel: fix RFC number in comment for INET_ECN_decapsulate()
2014-05-07 15:30:52 -04:00
percpu_counter: add @gfp to percpu_counter_init()
2014-09-08 09:51:29 +09:00
net: Use a more standard macro for INET_ADDR_COOKIE
2014-05-14 16:07:23 -04:00
ip: Add offset parameter to ip_cmsg_recv
2015-01-05 22:44:46 -05:00
inet: move ipv6only in sock_common
2014-07-01 23:46:21 -07:00
inet: remove dead inetpeer sequence code
2014-09-08 16:42:42 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-02-05 14:33:28 -08:00
net: add gro_compute_pseudo functions
2014-08-24 18:09:23 -07:00
net: fib6: convert cfg metric to u32 outside of table write lock
2015-01-05 22:55:24 -05:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-05-24 00:32:30 -04:00
tunnels: advertise link netns via netlink
2015-01-19 14:32:03 -05:00
fib_trie: Push rcu_read_lock/unlock to callers
2014-12-31 18:25:54 -05:00
tunnels: advertise link netns via netlink
2015-01-19 14:32:03 -05:00
ipvs: Clean up comment style in ip_vs.h
2014-10-02 18:30:58 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-02-05 14:33:28 -08:00
switch ipxrtr_route_packet() from iovec to msghdr
2014-11-24 04:28:49 -05:00
lib80211: remove unused print_ssid()
2014-10-14 02:18:27 +02:00
llc: Make llc_conn_ev_qfyr_t function pointer arrays const
2014-12-10 15:21:24 -05:00
llc: Make llc_sap_action_t function pointer arrays const
2014-12-10 15:21:24 -05:00
mac80111: Add BIP-GMAC-128 and BIP-GMAC-256 ciphers
2015-01-27 11:10:13 +01:00
ieee802154: rework cca setting
2014-12-19 00:19:23 +01:00
ipv6: mld: answer mldv2 queries with mldv1 reports in mldv1 fallback
2014-09-22 16:23:15 -04:00
openvswitch: Add basic MPLS support to kernel
2014-11-05 23:52:33 -08:00
neigh: remove next ptr from struct neigh_table
2014-12-26 17:07:08 -05:00
netns: add rtnl cmd to add and get peer netns ids
2015-01-19 14:21:18 -05:00
netlabel: fix the netlbl_catmap_setlong() dummy function
2014-08-07 20:55:21 -04:00
netlink: make nlmsg_end() and genlmsg_end() void
2015-01-18 01:03:45 -05:00
nl802154: introduce support for cca settings
2014-12-19 00:19:23 +01:00
ip: stash a pointer to msghdr in struct ping_fakehdr
2015-02-04 01:34:14 -05:00
net: sched: remove tcf_proto from ematch calls
2014-10-06 18:02:32 -04:00
net: rename vlan_tx_* helpers since "tx" is misleading there
2015-01-13 17:51:08 -05:00
net: Eliminate no_check from protosw
2014-05-23 16:28:53 -04:00
cfg80211: allow wiphy specific regdomain management
2014-12-17 11:49:55 +01:00
ipv4: per cpu uncached list
2015-01-15 18:26:16 -05:00
rtnl: add link netns id to interface messages
2015-01-19 14:21:26 -05:00
net: sched: fix panic in rate estimators
2015-01-31 17:49:37 -08:00
inetpeer: get rid of ip_id_count
2014-06-02 11:00:41 -07:00
Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
2014-10-15 07:48:18 +02:00
Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2015-02-04 20:46:55 -08:00
swdevice: add new apis to set and del bridge port attributes
2015-02-01 23:16:34 -08:00
tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks
2015-02-08 01:03:12 -08:00
net: Add a software TSO helper API
2014-05-22 14:57:15 -04:00
udp: Generalize skb_udp_segment
2014-10-01 21:35:51 -04:00
udp: Do not require sock in udp_tunnel_xmit_skb
2015-01-24 23:15:40 -08:00
net: switch memcpy_fromiovec()/memcpy_fromiovecend() users to copy_from_iter()
2015-02-04 01:34:15 -05:00
vxlan: Eliminate dependency on UDP socket in transmit path
2015-01-24 23:15:40 -08:00
net: treewide: Fix typo found in DocBook/networking.xml
2014-09-05 17:35:28 -07:00
xfrm: configure policy hash table thresholds by netlink
2014-09-02 13:37:56 +02:00
032ee42369