Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9b2c06d authored by Neal Cardwell's avatar Neal Cardwell Committed by David S. Miller
Browse files

tcp: mitigate ACK loops for connections as tcp_request_sock 



In the SYN_RECV state, where the TCP connection is represented by
tcp_request_sock, we now rate-limit SYNACKs in response to a client's
retransmitted SYNs: we do not send a SYNACK in response to client SYN
if it has been less than sysctl_tcp_invalid_ratelimit (default 500ms)
since we last sent a SYNACK in response to a client's retransmitted
SYN.

This allows the vast majority of legitimate client connections to
proceed unimpeded, even for the most aggressive platforms, iOS and
MacOS, which actually retransmit SYNs 1-second intervals for several
times in a row. They use SYN RTO timeouts following the progression:
1,1,1,1,1,2,4,8,16,32.

Reported-by: default avatarAvery Fay <avery@mixpanel.com>
Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 032ee423

include/linux/tcp.h

+1 −0
Original line number Diff line number Diff line
@@ -115,6 +115,7 @@ struct tcp_request_sock { 
	u32				rcv_isn;

	u32				snt_isn;

	u32				snt_synack; /* synack sent time */

	u32				last_oow_ack_time; /* last SYNACK */

	u32				rcv_nxt; /* the ack # by SYNACK. For

						  * FastOpen it's the seq#

						  * after data-in-SYN.

include/net/tcp.h

+1 −0
Original line number Diff line number Diff line
@@ -1145,6 +1145,7 @@ static inline void tcp_openreq_init(struct request_sock *req, 
	tcp_rsk(req)->rcv_isn = TCP_SKB_CB(skb)->seq;

	tcp_rsk(req)->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;

	tcp_rsk(req)->snt_synack = tcp_time_stamp;

	tcp_rsk(req)->last_oow_ack_time = 0;

	req->mss = rx_opt->mss_clamp;

	req->ts_recent = rx_opt->saw_tstamp ? rx_opt->rcv_tsval : 0;

	ireq->tstamp_ok = rx_opt->tstamp_ok;

net/ipv4/tcp_minisocks.c

+5 −1
Original line number Diff line number Diff line
@@ -605,7 +605,11 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, 
		 * Reset timer after retransmitting SYNACK, similar to

		 * the idea of fast retransmit in recovery.

		 */

		if (!inet_rtx_syn_ack(sk, req))

		if (!tcp_oow_rate_limited(sock_net(sk), skb,

					  LINUX_MIB_TCPACKSKIPPEDSYNRECV,

					  &tcp_rsk(req)->last_oow_ack_time) &&



		    !inet_rtx_syn_ack(sk, req))

			req->expires = min(TCP_TIMEOUT_INIT << req->num_timeout,

					   TCP_RTO_MAX) + jiffies;

		return NULL;