updates to syncookies - timestamps not needed any more (freebsd)

updates to syncookies - timestamps not needed any more (freebsd)

[Hannes Frederic Sowa]

Interesting patch by Andre Opperann of FreeBSD:
<http://lists.freebsd.org/pipermail/freebsd-net/2013-July/035999.html>

Greetings,

  Hannes

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Eric Dumazet]

On Mon, 2013-07-08 at 18:04 +0200, Hannes Frederic Sowa wrote:
> Interesting patch by Andre Opperann of FreeBSD:
> <http://lists.freebsd.org/pipermail/freebsd-net/2013-July/035999.html>
> 
> Greetings,


Switching from SHA to SipHash would be nice, if SipHash is secure
enough.

(We do not use MD5 but SHA for syncookies)

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Hannes Frederic Sowa]

On Mon, Jul 08, 2013 at 09:39:38AM -0700, Eric Dumazet wrote:
> On Mon, 2013-07-08 at 18:04 +0200, Hannes Frederic Sowa wrote:
> > Interesting patch by Andre Opperann of FreeBSD:
> > <http://lists.freebsd.org/pipermail/freebsd-net/2013-July/035999.html>
> > 
> > Greetings,
> 
> 
> Switching from SHA to SipHash would be nice, if SipHash is secure
> enough.
> 
> (We do not use MD5 but SHA for syncookies)

Blake2[0] came to my mind when I read this. It is by one of the same authors
as SipHash.

[0] https://blake2.net/

Greetings,

  Hannes

Re: updates to syncookies - timestamps not needed any more (freebsd)

[David Miller]

From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Mon, 8 Jul 2013 18:04:21 +0200

> Interesting patch by Andre Opperann of FreeBSD:
> <http://lists.freebsd.org/pipermail/freebsd-net/2013-July/035999.html>

Interesting work, but outside of the change of hash function I'm not so
sure.  The whole reason we went to the timestamp field was to eliminate
the coarse tables.

I understand that he claims that %99.99 of connections are handled by
the values he has chosen, but this is still a step backwards in my
opinion.

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Hannes Frederic Sowa]

On Thu, Jul 11, 2013 at 04:57:26PM -0700, David Miller wrote:
> From: Hannes Frederic Sowa <hannes@stressinduktion.org>
> Date: Mon, 8 Jul 2013 18:04:21 +0200
> 
> > Interesting patch by Andre Opperann of FreeBSD:
> > <http://lists.freebsd.org/pipermail/freebsd-net/2013-July/035999.html>
> 
> Interesting work, but outside of the change of hash function I'm not so
> sure.  The whole reason we went to the timestamp field was to eliminate
> the coarse tables.
> 
> I understand that he claims that %99.99 of connections are handled by
> the values he has chosen, but this is still a step backwards in my
> opinion.

If I understood this thread[0] correctly, it seems Windows 8 might not
enable TCP timestamps by default? I can not verify, I currently have
no Windows installations near me. That would mean, linux does, too,
fall back to an unscaled window connection as soon as syncookies kick in
(but we would not end up with an unsynchronized window scale option).

[0] http://thread.gmane.org/gmane.os.freebsd.devel.net/38211/focus=38216

Greetings,

  Hannes

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Eric Dumazet]

On Fri, 2013-07-12 at 03:41 +0200, Hannes Frederic Sowa wrote:

> If I understood this thread[0] correctly, it seems Windows 8 might not
> enable TCP timestamps by default? 

Who cares about Windows 8 anyway ?

;)

Re: updates to syncookies - timestamps not needed any more (freebsd)

[richard -rw- weinberger]

On Fri, Jul 12, 2013 at 3:41 AM, Hannes Frederic Sowa
<hannes@stressinduktion.org> wrote:
> On Thu, Jul 11, 2013 at 04:57:26PM -0700, David Miller wrote:
>> From: Hannes Frederic Sowa <hannes@stressinduktion.org>
>> Date: Mon, 8 Jul 2013 18:04:21 +0200
>>
>> > Interesting patch by Andre Opperann of FreeBSD:
>> > <http://lists.freebsd.org/pipermail/freebsd-net/2013-July/035999.html>
>>
>> Interesting work, but outside of the change of hash function I'm not so
>> sure.  The whole reason we went to the timestamp field was to eliminate
>> the coarse tables.
>>
>> I understand that he claims that %99.99 of connections are handled by
>> the values he has chosen, but this is still a step backwards in my
>> opinion.
>
> If I understood this thread[0] correctly, it seems Windows 8 might not
> enable TCP timestamps by default? I can not verify, I currently have
> no Windows installations near me. That would mean, linux does, too,
> fall back to an unscaled window connection as soon as syncookies kick in
> (but we would not end up with an unsynchronized window scale option).

My Windows 8 workstations here have it disabled by default.

--
Thanks,
//richard

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Rick Jones]

On 07/11/2013 11:59 PM, richard -rw- weinberger wrote:
> My Windows 8 workstations here have it disabled by default.

Do they enable window scaling?

rick jones

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Eric Dumazet]

On Fri, 2013-07-12 at 08:22 -0700, Rick Jones wrote:
> On 07/11/2013 11:59 PM, richard -rw- weinberger wrote:
> > My Windows 8 workstations here have it disabled by default.
> 
> Do they enable window scaling?

Yes, they do.

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Rick Jones]

On 07/12/2013 09:18 AM, Eric Dumazet wrote:
> On Fri, 2013-07-12 at 08:22 -0700, Rick Jones wrote:
>> On 07/11/2013 11:59 PM, richard -rw- weinberger wrote:
>>> My Windows 8 workstations here have it disabled by default.
>>
>> Do they enable window scaling?
>
> Yes, they do.

Tsk, tsk, tsk...  or am I believing too strongly in the importance of 
protection against wrapped sequence numbers?

rick jones

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Eric Dumazet]

On Fri, 2013-07-12 at 09:33 -0700, Rick Jones wrote:

> Tsk, tsk, tsk...  or am I believing too strongly in the importance of 
> protection against wrapped sequence numbers?


Presumably Microsoft do not expect their machines being able to transfer
TCP at high speed...

Re: updates to syncookies - timestamps not needed any more (freebsd)

[David Miller]

From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Fri, 12 Jul 2013 03:41:38 +0200

> If I understood this thread[0] correctly, it seems Windows 8 might not
> enable TCP timestamps by default?

That is true, and my opinion of the situation took this into
consideration.

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Florian Westphal]

David Miller <davem@davemloft.net> wrote:
> From: Hannes Frederic Sowa <hannes@stressinduktion.org>
> Date: Mon, 8 Jul 2013 18:04:21 +0200
> 
> > Interesting patch by Andre Opperann of FreeBSD:
> > <http://lists.freebsd.org/pipermail/freebsd-net/2013-July/035999.html>
> 
> Interesting work, but outside of the change of hash function I'm not so
> sure.  The whole reason we went to the timestamp field was to eliminate
> the coarse tables.
> 
> I understand that he claims that %99.99 of connections are handled by
> the values he has chosen, but this is still a step backwards in my
> opinion.

The main difference to what linux does is to avoid encoding the 'count'
value (Linux doesn't reseed secret[], and relies on count to detect old
cookies).

Not having the counter frees up space to encode tcp options in the cookie
instead of the timestamp.

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Eric Dumazet]

On Fri, 2013-07-12 at 10:41 +0200, Florian Westphal wrote:

> The main difference to what linux does is to avoid encoding the 'count'
> value (Linux doesn't reseed secret[], and relies on count to detect old
> cookies).
> 
> Not having the counter frees up space to encode tcp options in the cookie
> instead of the timestamp.

But still wscale and sack options are disabled.

lpq83:~# echo 0 >/proc/sys/net/ipv4/tcp_timestamps
lpq83:~# tcpdump -p -n -s 0 -i eth4

07:03:37.337563 IP 7.7.7.84.64131 > 7.7.7.83.22: S 1523884225:1523884225(0) win 29200 <mss 1460,sackOK,timestamp 74412758 0,nop,wscale 6>
07:03:37.337588 IP 7.7.7.83.22 > 7.7.7.84.64131: S 572330188:572330188(0) ack 1523884226 win 29200 <mss 1460>
07:03:37.337647 IP 7.7.7.84.64131 > 7.7.7.83.22: . ack 1 win 29200


BTW, following patch allows to test more easily syncookies behavior.

If sysctl_tcp_syncookies is set to 2, we always use syncookies.

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 35675e4..590659e 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1462,7 +1462,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	 * limitations, they conserve resources and peer is
 	 * evidently real one.
 	 */
-	if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
+	if ((sysctl_tcp_syncookies == 2 ||
+	     inet_csk_reqsk_queue_is_full(sk)) && !isn) {
 		want_cookie = tcp_syn_flood_action(sk, skb, "TCP");
 		if (!want_cookie)
 			goto drop;

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Florian Westphal]

Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Fri, 2013-07-12 at 10:41 +0200, Florian Westphal wrote:
> 
> > The main difference to what linux does is to avoid encoding the 'count'
> > value (Linux doesn't reseed secret[], and relies on count to detect old
> > cookies).
> > 
> > Not having the counter frees up space to encode tcp options in the cookie
> > instead of the timestamp.
> 
> But still wscale and sack options are disabled.

Yes, in Linux sack and wscale will be encoded in the timestamp, as
cookie is already restricted to 24 bits due to counter.

Without the counter, that could be changed to allow sack/wscale even
with ts off.

> BTW, following patch allows to test more easily syncookies behavior.
> 
> If sysctl_tcp_syncookies is set to 2, we always use syncookies.

I think this change would be useful.

> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -1462,7 +1462,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
>  	 * limitations, they conserve resources and peer is
>  	 * evidently real one.
>  	 */
> -	if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
> +	if ((sysctl_tcp_syncookies == 2 ||
> +	     inet_csk_reqsk_queue_is_full(sk)) && !isn) {
>  		want_cookie = tcp_syn_flood_action(sk, skb, "TCP");
>  		if (!want_cookie)

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Eric Dumazet]

On Fri, 2013-07-12 at 16:25 +0200, Florian Westphal wrote:
> Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > On Fri, 2013-07-12 at 10:41 +0200, Florian Westphal wrote:
> > 
> > > The main difference to what linux does is to avoid encoding the 'count'
> > > value (Linux doesn't reseed secret[], and relies on count to detect old
> > > cookies).
> > > 
> > > Not having the counter frees up space to encode tcp options in the cookie
> > > instead of the timestamp.
> > 
> > But still wscale and sack options are disabled.
> 
> Yes, in Linux sack and wscale will be encoded in the timestamp, as
> cookie is already restricted to 24 bits due to counter.
> 
> Without the counter, that could be changed to allow sack/wscale even
> with ts off.

Another quick hack would be to allow sack being generated by the client.

If we receive sackOK in SYN, then syncookie SYNACK could contain sackOK,
if timestamps are not used.

Client would be allowed to use SACK in his ACK. Server would not
generate SACK, but would process incoming SACK.

Not sure what could break ?

Re: updates to syncookies - timestamps not needed any more (freebsd)

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Fri, 12 Jul 2013 07:32:43 -0700

> Another quick hack would be to allow sack being generated by the client.
> 
> If we receive sackOK in SYN, then syncookie SYNACK could contain sackOK,
> if timestamps are not used.
> 
> Client would be allowed to use SACK in his ACK. Server would not
> generate SACK, but would process incoming SACK.
> 
> Not sure what could break ?

This seems quite clumsy and would result in being able to use SACK only
in one direction.

There has to be a better way.

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Hannes Frederic Sowa]

Hi Eric!

On Fri, Jul 12, 2013 at 07:04:45AM -0700, Eric Dumazet wrote:
> BTW, following patch allows to test more easily syncookies behavior.
> 
> If sysctl_tcp_syncookies is set to 2, we always use syncookies.
> 
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index 35675e4..590659e 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -1462,7 +1462,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
>  	 * limitations, they conserve resources and peer is
>  	 * evidently real one.
>  	 */
> -	if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
> +	if ((sysctl_tcp_syncookies == 2 ||
> +	     inet_csk_reqsk_queue_is_full(sk)) && !isn) {
>  		want_cookie = tcp_syn_flood_action(sk, skb, "TCP");
>  		if (!want_cookie)
>  			goto drop;
> 

While cleaning up my patch directory I found this snippet. Perhaps you
could send it for inclusion for net-next? Three nice additions: a similar
change in tcp_ipv6.c and perhaps get rid of the warning messages printed
to the console in case of syncookies == 2? A small update to ip-sysctl.txt
wouldn't hurt either.

If you want to, I can take it and refresh it.

Thanks,

  Hannes

Re: updates to syncookies - timestamps not needed any more (freebsd)

[Eric Dumazet]

On Fri, 2013-07-26 at 08:45 +0200, Hannes Frederic Sowa wrote:
> Hi Eric!

Hi Hannes

> While cleaning up my patch directory I found this snippet. Perhaps you
> could send it for inclusion for net-next? Three nice additions: a similar
> change in tcp_ipv6.c and perhaps get rid of the warning messages printed
> to the console in case of syncookies == 2? A small update to ip-sysctl.txt
> wouldn't hurt either.
> 
> If you want to, I can take it and refresh it.

That would be a good idea, as I am currently traveling ;)

Thanks !