Commit 4ce7e93c authored Apr 01, 2016 by Eric Dumazet Committed by David S. Miller Apr 04, 2016

tcp: rate limit ACK sent by SYN_RECV request sockets



Attackers like to use SYNFLOOD targeting one 5-tuple, as they
hit a single RX queue (and cpu) on the victim.

If they use random sequence numbers in their SYN, we detect
they do not match the expected window and send back an ACK.

This patch adds a rate limitation, so that the effect of such
attacks is limited to ingress only.

We roughly double our ability to absorb such attacks.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Maciej Żenczykowski <maze@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a9d6532b

net/ipv4/tcp_minisocks.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -704,7 +704,10 @@ struct sock tcp_check_req(struct sock sk, struct sk_buff *skb,
		if (paws_reject \|\| !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
		tcp_rsk(req)->rcv_nxt, tcp_rsk(req)->rcv_nxt + req->rsk_rcv_wnd)) {
		/* Out of window: send ACK and drop. */
		if (!(flg & TCP_FLAG_RST))
		if (!(flg & TCP_FLAG_RST) &&
		!tcp_oow_rate_limited(sock_net(sk), skb,
		LINUX_MIB_TCPACKSKIPPEDSYNRECV,
		&tcp_rsk(req)->last_oow_ack_time))
		req->rsk_ops->send_ack(sk, skb, req);
		if (paws_reject)
		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);

Admin message