tcp_syncache: add net.inet.tcp.syncache.see_other sysctl
A security feature from c06f087ccb
appeared to be a huge bottleneck
under SYN flood. To mitigate that add a sysctl that would make
syncache(4) globally visible, ignoring UID/GID, jail(2) and mac(4)
checks. When turned on, we won't need to call crhold() on the listening
socket credential for every incoming SYN packet.
Reviewed by: bz
This commit is contained in:
parent
34256484af
commit
cb8d7c44d6
@ -12,7 +12,7 @@
|
|||||||
.\"
|
.\"
|
||||||
.\" $FreeBSD$
|
.\" $FreeBSD$
|
||||||
.\"
|
.\"
|
||||||
.Dd January 22, 2008
|
.Dd April 12, 2021
|
||||||
.Dt SYNCACHE 4
|
.Dt SYNCACHE 4
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
@ -39,6 +39,8 @@ MIBs for controlling TCP SYN caching
|
|||||||
.Nm sysctl Cm net.inet.tcp.syncache.rexmtlimit
|
.Nm sysctl Cm net.inet.tcp.syncache.rexmtlimit
|
||||||
.It
|
.It
|
||||||
.Nm sysctl Cm net.inet.tcp.syncache.count
|
.Nm sysctl Cm net.inet.tcp.syncache.count
|
||||||
|
.It
|
||||||
|
.Nm sysctl Cm net.inet.tcp.syncache.see_other
|
||||||
.El
|
.El
|
||||||
.Sh DESCRIPTION
|
.Sh DESCRIPTION
|
||||||
The
|
The
|
||||||
@ -150,6 +152,25 @@ Tunable via
|
|||||||
Number of entries present in the
|
Number of entries present in the
|
||||||
.Nm
|
.Nm
|
||||||
(read-only).
|
(read-only).
|
||||||
|
.It Va see_other
|
||||||
|
If set to true value, all
|
||||||
|
.Nm
|
||||||
|
entries will be visible via
|
||||||
|
.Va net.inet.tcp.pcblist
|
||||||
|
sysctl, or via
|
||||||
|
.Xr netstat 1 ,
|
||||||
|
ignoring all of
|
||||||
|
.Xr security 7
|
||||||
|
UID/GID,
|
||||||
|
.Xr jail 2
|
||||||
|
and
|
||||||
|
.Xr mac 4
|
||||||
|
checks.
|
||||||
|
If turned off, the visibility checks are enforced.
|
||||||
|
However, extra
|
||||||
|
.Xr ucred 9
|
||||||
|
referencing is required on every incoming SYN packet processed.
|
||||||
|
The default is off.
|
||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
Statistics on the performance of the
|
Statistics on the performance of the
|
||||||
@ -192,9 +213,13 @@ Connections created from segment containing ACK.
|
|||||||
.El
|
.El
|
||||||
.Sh SEE ALSO
|
.Sh SEE ALSO
|
||||||
.Xr netstat 1 ,
|
.Xr netstat 1 ,
|
||||||
|
.Xr jail 2 ,
|
||||||
|
.Xr mac ,
|
||||||
.Xr tcp 4 ,
|
.Xr tcp 4 ,
|
||||||
|
.Xr security 7,
|
||||||
.Xr loader 8 ,
|
.Xr loader 8 ,
|
||||||
.Xr sysctl 8
|
.Xr sysctl 8 ,
|
||||||
|
.Xr ucred 9
|
||||||
.Sh HISTORY
|
.Sh HISTORY
|
||||||
The existing
|
The existing
|
||||||
.Nm
|
.Nm
|
||||||
|
@ -191,6 +191,11 @@ SYSCTL_UINT(_net_inet_tcp_syncache, OID_AUTO, hashsize, CTLFLAG_VNET | CTLFLAG_R
|
|||||||
&VNET_NAME(tcp_syncache.hashsize), 0,
|
&VNET_NAME(tcp_syncache.hashsize), 0,
|
||||||
"Size of TCP syncache hashtable");
|
"Size of TCP syncache hashtable");
|
||||||
|
|
||||||
|
SYSCTL_BOOL(_net_inet_tcp_syncache, OID_AUTO, see_other, CTLFLAG_VNET |
|
||||||
|
CTLFLAG_RW, &VNET_NAME(tcp_syncache.see_other), 0,
|
||||||
|
"All syncache(4) entries are visible, ignoring UID/GID, jail(2) "
|
||||||
|
"and mac(4) checks");
|
||||||
|
|
||||||
static int
|
static int
|
||||||
sysctl_net_inet_tcp_syncache_rexmtlimit_check(SYSCTL_HANDLER_ARGS)
|
sysctl_net_inet_tcp_syncache_rexmtlimit_check(SYSCTL_HANDLER_ARGS)
|
||||||
{
|
{
|
||||||
@ -1409,7 +1414,7 @@ syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
|
|||||||
*/
|
*/
|
||||||
KASSERT(SOLISTENING(so), ("%s: %p not listening", __func__, so));
|
KASSERT(SOLISTENING(so), ("%s: %p not listening", __func__, so));
|
||||||
tp = sototcpcb(so);
|
tp = sototcpcb(so);
|
||||||
cred = crhold(so->so_cred);
|
cred = V_tcp_syncache.see_other ? NULL : crhold(so->so_cred);
|
||||||
|
|
||||||
#ifdef INET6
|
#ifdef INET6
|
||||||
if (inc->inc_flags & INC_ISIPV6) {
|
if (inc->inc_flags & INC_ISIPV6) {
|
||||||
@ -2498,7 +2503,8 @@ syncache_pcblist(struct sysctl_req *req)
|
|||||||
sch = &V_tcp_syncache.hashbase[i];
|
sch = &V_tcp_syncache.hashbase[i];
|
||||||
SCH_LOCK(sch);
|
SCH_LOCK(sch);
|
||||||
TAILQ_FOREACH(sc, &sch->sch_bucket, sc_hash) {
|
TAILQ_FOREACH(sc, &sch->sch_bucket, sc_hash) {
|
||||||
if (cr_cansee(req->td->td_ucred, sc->sc_cred) != 0)
|
if (sc->sc_cred != NULL &&
|
||||||
|
cr_cansee(req->td->td_ucred, sc->sc_cred) != 0)
|
||||||
continue;
|
continue;
|
||||||
if (sc->sc_inc.inc_flags & INC_ISIPV6)
|
if (sc->sc_inc.inc_flags & INC_ISIPV6)
|
||||||
xt.xt_inp.inp_vflag = INP_IPV6;
|
xt.xt_inp.inp_vflag = INP_IPV6;
|
||||||
|
@ -134,6 +134,7 @@ struct tcp_syncache {
|
|||||||
time_t pause_until;
|
time_t pause_until;
|
||||||
uint8_t pause_backoff;
|
uint8_t pause_backoff;
|
||||||
volatile bool paused;
|
volatile bool paused;
|
||||||
|
bool see_other;
|
||||||
};
|
};
|
||||||
|
|
||||||
/* Internal use for the syncookie functions. */
|
/* Internal use for the syncookie functions. */
|
||||||
|
Loading…
Reference in New Issue
Block a user