On 16/12/18 - 22:30:51, Eric Dumazet wrote: > > > On 12/14/2018 02:40 PM, Christoph Paasch wrote: > > This change allows to search for the right cookie and accepts old ones > > (announcing a new one if it has changed). > > > > __tcp_fastopen_cookie_gen_with_ctx() allows to generate a cookie based > > on a given TFO-context. A later patch will cleanup the duplicate code. > > How long is kept the secondary (old) context ?
There is no time-limit on keeping the older context. In an older version of this series I had the pool-size as a sysctl so one could try out different configurations. For us, a size of 2 was good enough. I could bring that back if you think it's useful. > I do not know exact crypto_cipher_encrypt_one() cost, but it looks like > your patch could double the cost of some TFO based attacks ? True, we are doing more crypto if we are getting a lot of invalid or old cookies. I don't have a good answer to that besides that one should probably disable TFO at that point ;-) On the other hand, AFAICS tcp_conn_request will end up setting want_cookie to true under SYN-flooding so we won't even enter tcp_try_fastopen if it's really an attack. Christoph
