lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
c074da2810
linux-kernel-test/net/ipv4
History
Eric Dumazet c074da2810 ipv4: tcp: dont cache unconfirmed intput dst 
DDOS synflood attacks hit badly IP route cache.

On typical machines, this cache is allowed to hold up to 8 Millions dst
entries, 256 bytes for each, for a total of 2GB of memory.

rt_garbage_collect() triggers and tries to cleanup things.

Eventually route cache is disabled but machine is under fire and might
OOM and crash.

This patch exploits the new TCP early demux, to set a nocache
boolean in case incoming TCP frame is for a not yet ESTABLISHED or
TIMEWAIT socket.

This 'nocache' boolean is then used in case dst entry is not found in
route cache, to create an unhashed dst entry (DST_NOCACHE)

SYN-cookie-ACK sent use a similar mechanism (ipv4: tcp: dont cache
output dst for syncookies), so after this patch, a machine is able to
absorb a DDOS synflood attack without polluting its IP route cache.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Hans Schillstrom <hans.schillstrom@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-06-27 15:34:24 -07:00
..
netfilter netfilter: ipt_ULOG: Move away from NLMSG_PUT(). 2012-06-26 21:30:49 -07:00
af_inet.c ipv4: Early TCP socket demux. 2012-06-19 21:22:05 -07:00
ah4.c ipv4: Handle PMTU in all ICMP error handlers. 2012-06-14 22:22:07 -07:00
arp.c ipv4: tcp: dont cache unconfirmed intput dst 2012-06-27 15:34:24 -07:00
cipso_ipv4.c ipv4: Convert call_rcu() to kfree_rcu(), drop opt_kfree_rcu() 2012-02-21 09:03:31 -08:00
datagram.c
devinet.c ipv4: Add interface option to enable routing of 127.0.0.0/8 2012-06-12 15:25:46 -07:00
esp4.c ipv4: Handle PMTU in all ICMP error handlers. 2012-06-14 22:22:07 -07:00
fib_frontend.c net: cleanup unsigned to unsigned int 2012-04-15 12:44:40 -04:00
fib_lookup.h
fib_rules.c ipv4: Stop using NLA_PUT*(). 2012-04-02 04:33:43 -04:00
fib_semantics.c ipv4: Cap ADVMSS metric in the FIB rather than the routing cache. 2012-06-17 19:47:34 -07:00
fib_trie.c inet: Add inetpeer tree roots to the FIB tables. 2012-06-11 02:09:16 -07:00
gre.c net: ipv4: Standardize prefixes for message logging 2012-03-12 17:05:21 -07:00
icmp.c inet: Sanitize inet{,6} protocol demux. 2012-06-19 18:56:21 -07:00
igmp.c ipv4: fix checkpatch errors 2012-04-15 12:37:19 -04:00
inet_connection_sock.c ipv4: tcp: dont cache output dst for syncookies 2012-06-22 21:47:33 -07:00
inet_diag.c inet_diag: Move away from NLMSG_PUT(). 2012-06-26 21:28:54 -07:00
inet_fragment.c inetpeer: add parameter net for inet_getpeer_v4,v6 2012-06-08 14:27:23 -07:00
inet_hashtables.c ipv4: fix checkpatch errors 2012-04-15 12:37:19 -04:00
inet_lro.c
inet_timewait_sock.c net: ipv4 and ipv6: Convert printk(KERN_DEBUG to pr_debug 2012-05-16 01:01:03 -04:00
inetpeer.c inetpeer: inetpeer_invalidate_tree() cleanup 2012-06-20 14:38:55 -07:00
ip_forward.c snmp: fix OutOctets counter to include forwarded datagrams 2012-06-07 14:50:56 -07:00
ip_fragment.c ipv4: tcp: dont cache unconfirmed intput dst 2012-06-27 15:34:24 -07:00
ip_gre.c ipv4: Handle PMTU in all ICMP error handlers. 2012-06-14 22:22:07 -07:00
ip_input.c ipv4: tcp: dont cache unconfirmed intput dst 2012-06-27 15:34:24 -07:00
ip_options.c net: Convert net_ratelimit uses to net_<level>_ratelimited 2012-05-15 13:45:03 -04:00
ip_output.c net-next: add dev_loopback_xmit() to avoid duplicate code 2012-06-12 18:51:09 -07:00
ip_sockglue.c net: IP_MULTICAST_IF setsockopt now recognizes struct mreq 2012-05-07 23:03:22 -04:00
ipcomp.c ipv4: Handle PMTU in all ICMP error handlers. 2012-06-14 22:22:07 -07:00
ipconfig.c net/ipv4/ipconfig: neaten __setup placement 2012-05-20 04:06:16 -04:00
ipip.c ipv4: Handle PMTU in all ICMP error handlers. 2012-06-14 22:22:07 -07:00
ipmr.c snmp: fix OutOctets counter to include forwarded datagrams 2012-06-07 14:50:56 -07:00
Kconfig net: delete all instances of special processing for token ring 2012-05-15 20:14:35 -04:00
Makefile tcp memory pressure controls 2011-12-12 19:04:10 -05:00
netfilter.c net: Delete all remaining instances of ctl_path 2012-04-20 21:22:30 -04:00
ping.c ipv4: Handle PMTU in all ICMP error handlers. 2012-06-14 22:22:07 -07:00
proc.c tcp: reduce out_of_order memory use 2012-03-19 16:53:08 -04:00
protocol.c inet: Sanitize inet{,6} protocol demux. 2012-06-19 18:56:21 -07:00
raw.c ipv4: Handle PMTU in all ICMP error handlers. 2012-06-14 22:22:07 -07:00
route.c ipv4: tcp: dont cache unconfirmed intput dst 2012-06-27 15:34:24 -07:00
syncookies.c tcp: fix syncookie regression 2012-03-11 15:52:12 -07:00
sysctl_net_ipv4.c ipv4: Add sysctl knob to control early socket demux 2012-06-22 17:11:13 -07:00
tcp_bic.c tcp: fix undo after RTO for BIC 2012-01-20 14:17:26 -05:00
tcp_cong.c tcp: bool conversions 2012-05-17 14:59:59 -04:00
tcp_cubic.c tcp: fix undo after RTO for CUBIC 2012-01-20 14:17:26 -05:00
tcp_diag.c inet_diag: Rename inet_diag_req into inet_diag_req_v2 2012-01-11 12:56:06 -08:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c tcp: bool conversions 2012-05-17 14:59:59 -04:00
tcp_illinois.c
tcp_input.c ipv4: Early TCP socket demux. 2012-06-19 21:22:05 -07:00
tcp_ipv4.c ipv4: tcp: dont cache unconfirmed intput dst 2012-06-27 15:34:24 -07:00
tcp_lp.c
tcp_memcontrol.c memcg: decrement static keys at real destroy time 2012-05-29 16:22:28 -07:00
tcp_minisocks.c ipv4: Early TCP socket demux. 2012-06-19 21:22:05 -07:00
tcp_output.c tcp: tcp_make_synack() consumes dst parameter 2012-06-04 11:27:39 -04:00
tcp_probe.c net: cleanup unsigned to unsigned int 2012-04-15 12:44:40 -04:00
tcp_scalable.c
tcp_timer.c tcp: early retransmit: delayed fast retransmit 2012-05-02 20:56:10 -04:00
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tcp.c mm: add a low limit to alloc_large_system_hash 2012-05-24 00:28:21 -04:00
tunnel4.c net: Convert printks to pr_<level> 2012-03-11 23:42:51 -07:00
udp_diag.c udp_diag: implement idiag_get_info for udp/udplite to get queue information 2012-04-25 20:43:01 -04:00
udp_impl.h ipv4: fix checkpatch errors 2012-04-15 12:37:19 -04:00
udp.c ipv4: Handle PMTU in all ICMP error handlers. 2012-06-14 22:22:07 -07:00
udplite.c net: ipv4: Standardize prefixes for message logging 2012-03-12 17:05:21 -07:00
xfrm4_input.c ipv4: tcp: dont cache unconfirmed intput dst 2012-06-27 15:34:24 -07:00
xfrm4_mode_beet.c ipsec: be careful of non existing mac headers 2012-02-23 16:50:45 -05:00
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c ipsec: be careful of non existing mac headers 2012-02-23 16:50:45 -05:00
xfrm4_output.c
xfrm4_policy.c inet: Hide route peer accesses behind helpers. 2012-06-11 02:08:47 -07:00
xfrm4_state.c
xfrm4_tunnel.c net: ipv4: Standardize prefixes for message logging 2012-03-12 17:05:21 -07:00