Eric Dumazet
c074da2810
ipv4: tcp: dont cache unconfirmed intput dst ...
DDOS synflood attacks hit badly IP route cache.
On typical machines, this cache is allowed to hold up to 8 Millions dst
entries, 256 bytes for each, for a total of 2GB of memory.
rt_garbage_collect() triggers and tries to cleanup things.
Eventually route cache is disabled but machine is under fire and might
OOM and crash.
This patch exploits the new TCP early demux, to set a nocache
boolean in case incoming TCP frame is for a not yet ESTABLISHED or
TIMEWAIT socket.
This 'nocache' boolean is then used in case dst entry is not found in
route cache, to create an unhashed dst entry (DST_NOCACHE)
SYN-cookie-ACK sent use a similar mechanism (ipv4: tcp: dont cache
output dst for syncookies), so after this patch, a machine is able to
absorb a DDOS synflood attack without polluting its IP route cache.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Hans Schillstrom <hans.schillstrom@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-06-27 15:34:24 -07:00
9p: Reduce object size with CONFIG_NET_9P_DEBUG
2012-01-05 10:51:44 -06:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
2012-06-13 15:35:35 -04:00
caif-hsi: Remove use of module parameters
2012-06-25 16:44:12 -07:00
af_iucv: add shutdown for HS transport
2012-03-07 22:52:24 -08:00
netfilter: fix missing symbols if CONFIG_NETFILTER_NETLINK_QUEUE_CT unset
2012-06-18 21:09:17 -07:00
Merge branch 'master' of git://1984.lsi.us.es/net-next
2012-06-11 12:56:14 -07:00
NFC: Introduce target mode rx data callback
2012-06-04 21:34:31 +02:00
net: remove my future former mail address
2012-06-17 16:29:38 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2012-05-16 22:17:37 -04:00
ipv6: bool/const conversions phase2
2012-05-19 01:08:16 -04:00
af_unix: speedup /proc/net/unix
2012-06-08 14:27:23 -07:00
ipv4: Eliminate spurious argument to __ipv4_neigh_lookup
2012-02-15 17:48:35 -05:00
atm: clip: Use device neigh support on top of "arp_tbl".
2011-11-30 18:51:03 -05:00
net ax25: Fix the build when sysctl support is disabled.
2012-04-23 22:14:47 -04:00
cfg80211: clarify set_channel APIs
2012-06-06 15:18:17 -04:00
cipso: handle CIPSO options correctly when NetLabel is disabled
2012-06-01 14:18:29 -04:00
fq_codel: should use qdisc backlog as threshold
2012-05-16 15:30:26 -04:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
dcb: Add stub routines for !CONFIG_DCB
2011-10-06 15:49:51 -04:00
net/dcb: Add an optional max rate attribute
2012-04-05 05:08:04 -04:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
dsa: Include linux/if_ether.h to fix build error
2011-12-01 11:41:06 -05:00
include/net/dst.h: neaten asterisk placement
2012-06-16 15:20:35 -07:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
ipv4: tcp: dont cache output dst for syncookies
2012-06-22 21:47:33 -07:00
flow_dissector: use a 64bit load/store
2011-11-29 13:17:03 -05:00
net: Deinline __nlmsg_put and genlmsg_put. -7k code on i386 defconfig.
2012-01-30 15:22:06 -05:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
wireless: move ieee80211chan2mhz macro
2011-11-11 12:32:50 -05:00
6LoWPAN: add fragmentation support
2011-11-14 00:19:42 -05:00
mac802154: declare reduced mlme operations
2012-05-16 15:16:56 -04:00
net: delete all instances of special processing for token ring
2012-05-15 20:14:35 -04:00
tcp: bind() use stronger condition for bind_conflict
2012-04-14 15:28:55 -04:00
net: use IS_ENABLED(CONFIG_IPV6)
2011-12-11 18:25:16 -05:00
ipv4: tcp: dont cache output dst for syncookies
2012-06-22 21:47:33 -07:00
inet: add rfc 3168 extract in front of INET_ECN_encapsulate()
2011-10-22 01:25:23 -04:00
ip_frag: struct inet_frags match() method returns a bool
2012-05-18 01:40:27 -04:00
ipv4: Early TCP socket demux.
2012-06-19 21:22:05 -07:00
net: implement IP_RECVTOS for IP_PKTOPTIONS
2012-02-13 00:46:41 -05:00
inet: remove rcu protection on tw_net
2011-12-14 13:34:55 -05:00
inet: Avoid potential NULL peer dereference.
2012-06-11 04:13:57 -07:00
ipv4: Add sysctl knob to control early socket demux
2012-06-22 17:11:13 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2012-06-16 01:23:04 -07:00
ipv6: Handle PMTU in ICMP error handlers.
2012-06-15 14:54:11 -07:00
inet: Add inetpeer tree roots to the FIB tables.
2012-06-11 02:09:16 -07:00
ipvs: add support for sync threads
2012-05-08 19:40:33 +02:00
tunnel: implement 64 bits statistics
2012-04-14 14:47:05 -04:00
ipv6: bool/const conversions phase2
2012-05-19 01:08:16 -04:00
lapb: Neaten debugging
2012-05-17 18:45:20 -04:00
include: replace linux/module.h with "struct module" wherever possible
2011-10-31 19:32:32 -04:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
net: delete all instances of special processing for token ring
2012-05-15 20:14:35 -04:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
2012-06-13 15:35:35 -04:00
mac802154: add wpan device-class support
2012-06-26 21:06:11 -07:00
Treat ND option 31 as userland (DNSSL support)
2012-04-12 15:56:57 -04:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
net sysctl: Add place holder functions for when sysctl support is compiled out of the kernel.
2012-04-23 19:24:28 -04:00
netlink: Delete all NLA_PUT*() macros.
2012-04-02 04:33:45 -04:00
netprio_cgroup: fix wrong memory access when NETPRIO_CGROUP=m
2012-02-10 15:08:57 -05:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
ipv4: tcp: dont cache unconfirmed intput dst
2012-06-27 15:34:24 -07:00
ipv6: bool/const conversions phase2
2012-05-19 01:08:16 -04:00
net_sched: red: Make minor corrections to comments
2012-04-16 23:53:11 -04:00
cfg80211: pass DFS region to drivers through reg_notifier()
2011-11-21 16:20:41 -05:00
tcp: Change possible SYN flooding messages
2011-09-15 14:49:43 -04:00
ipv4: tcp: dont cache unconfirmed intput dst
2012-06-27 15:34:24 -07:00
rtnetlink: ops->get_tx_queue() cannot take a const 'tb'.
2012-04-13 14:21:04 -04:00
bonding: Fix corrupted queue_mapping
2012-06-12 15:29:21 -07:00
af_unix: dont send SCM_CREDENTIALS by default
2011-09-28 13:29:50 -04:00
tcp: add const qualifiers where possible
2011-10-21 05:22:42 -04:00
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
2012-01-09 13:08:28 -08:00
net: struct sock cleanups
2012-06-25 16:09:18 -07:00
ipv4: tcp: dont cache unconfirmed intput dst
2012-06-27 15:34:24 -07:00
cgroup: pass struct mem_cgroup instead of struct cgroup to socket memcg
2012-04-10 10:04:07 -07:00
[PATCH] tcp: Cache inetpeer in timewait socket, and only when necessary.
2012-06-09 14:56:12 -07:00
net: relax PKTINFO non local ipv6 udp xmit check
2011-08-30 17:39:01 -04:00
net/ipv6/udp: UDP encapsulation: introduce encap_rcv hook into IPv6
2012-04-28 22:21:51 -04:00
net: ipv4: Standardize prefixes for message logging
2012-03-12 17:05:21 -07:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
mac802154: monitor device support
2012-05-16 15:17:08 -04:00
net: cleanup unsigned to unsigned int
2012-04-15 12:44:40 -04:00
xfrm: Convert several xfrm policy match functions to bool.
2012-05-15 15:04:57 -04:00
c074da2810