Neal Cardwell
032ee42369
tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks ...
Helpers for mitigating ACK loops by rate-limiting dupacks sent in
response to incoming out-of-window packets.
This patch includes:
- rate-limiting logic
- sysctl to control how often we allow dupacks to out-of-window packets
- SNMP counter for cases where we rate-limited our dupack sending
The rate-limiting logic in this patch decides to not send dupacks in
response to out-of-window segments if (a) they are SYNs or pure ACKs
and (b) the remote endpoint is sending them faster than the configured
rate limit.
We rate-limit our responses rather than blocking them entirely or
resetting the connection, because legitimate connections can rely on
dupacks in response to some out-of-window segments. For example, zero
window probes are typically sent with a sequence number that is below
the current window, and ZWPs thus expect to thus elicit a dupack in
response.
We allow dupacks in response to TCP segments with data, because these
may be spurious retransmissions for which the remote endpoint wants to
receive DSACKs. This is safe because segments with data can't
realistically be part of ACK loops, which by their nature consist of
each side sending pure/data-less ACKs to each other.
The dupack interval is controlled by a new sysctl knob,
tcp_invalid_ratelimit, given in milliseconds, in case an administrator
needs to dial this upward in the face of a high-rate DoS attack. The
name and units are chosen to be analogous to the existing analogous
knob for ICMP, icmp_ratelimit.
The default value for tcp_invalid_ratelimit is 500ms, which allows at
most one such dupack per 500ms. This is chosen to be 2x faster than
the 1-second minimum RTO interval allowed by RFC 6298 (section 2, rule
2.4). We allow the extra 2x factor because network delay variations
can cause packets sent at 1 second intervals to be compressed and
arrive much closer.
Reported-by: Avery Fay <avery@mixpanel.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-08 01:03:12 -08:00
Revert "Documentation: Add entry for dell-laptop sysfs interface"
2015-01-23 11:10:12 -08:00
Documentation: use subdir-y to avoid unnecessary built-in.o files
2014-09-26 11:02:55 +02:00
ACPI / GPIO: Document ACPI GPIO mappings API
2014-11-04 21:58:24 +01:00
Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm
2014-12-12 15:26:48 -08:00
arm64: Emulate CP15 Barrier instructions
2014-11-20 16:34:48 +00:00
Documentation: use subdir-y to avoid unnecessary built-in.o files
2014-09-26 11:02:55 +02:00
Documentation: add makefiles for more targets
2014-09-26 11:02:56 +02:00
Merge branch 'for-3.19/core' of git://git.kernel.dk/linux-block
2014-12-13 14:14:23 -08:00
zram: report maximum used memory
2014-10-09 22:26:02 -04:00
Merge branch 'akpm' (second patch-bomb from Andrew)
2014-12-13 13:00:36 -08:00
w1: optional bundling of netlink kernel replies
2014-05-27 13:56:21 -07:00
intel_pstate: Add support for HWP
2014-11-12 00:04:38 +01:00
crypto: doc - userspace interface spec
2014-11-13 22:31:38 +08:00
Documentation: remove outdated references to the linux-next wiki
2014-10-28 09:06:11 -04:00
dm cache policy mq: simplify ability to promote sequential IO to the cache
2014-11-10 15:25:30 -05:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-02-05 14:33:28 -08:00
Documentation: dmanegine: move dmatest.txt to dmaengine folder
2014-11-06 11:17:37 +05:30
Last round of updates for net-next:
2015-02-04 14:57:45 -08:00
PCI changes for the v3.18 merge window:
2014-10-09 15:03:49 -04:00
[media] get_dvb_firmware: Update firmware of ITEtech IT9135
2014-09-21 17:03:04 -03:00
drm: Add 800x600 (SVGA) screen resolution to the built-in EDIDs
2014-05-26 12:53:40 +10:00
doc: spelling error changes
2014-05-05 15:32:05 +02:00
These patches optionally add LZ4 compression support to Squashfs.
2014-12-14 14:42:53 -08:00
doc: fix minor typos in firmware_class README
2014-07-17 18:43:40 -07:00
This is the bulk of GPIO changes for the v3.19 series:
2014-12-14 14:05:05 -08:00
HID: uhid: update documentation
2014-08-25 03:28:09 -05:00
hwmon: (tmp401) Detect TMP435 on all addresses it supports
2014-12-08 06:48:37 -08:00
Documentation: i2c: Use PM ops instead of legacy suspend/resume
2014-12-04 19:09:03 +01:00
kvm: Documentation: remove ia64
2014-11-20 11:08:55 +01:00
IB/mad: add new ioctl to ABI to support new registration options
2014-08-10 20:36:00 -07:00
Docs changes for the 3.19 merge window
2014-12-12 14:42:48 -08:00
cxl: Add documentation for userspace APIs
2014-10-08 20:16:19 +11:00
Documentation: kbuild: Improve grammar
2014-08-19 10:02:56 +02:00
kernel: add panic_on_warn
2014-12-10 17:41:10 -08:00
Documentation: update .gitignore files
2014-09-26 11:02:59 +02:00
Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-12-09 19:59:22 -08:00
Documentation: Build mic/mpssd only for x86_64
2014-12-05 11:18:36 -05:00
Documentation: au1xxx-ide.c has moved
2014-08-26 09:35:53 +02:00
Documentation: use subdir-y to avoid unnecessary built-in.o files
2014-09-26 11:02:55 +02:00
MTD updates for 3.16:
2014-06-11 08:35:34 -07:00
tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks
2015-02-08 01:03:12 -08:00
Documentation: Add documentation for Nios2 architecture
2014-12-08 12:56:06 +08:00
doc: replace "practise" with "practice" in Documentation
2014-06-19 15:28:56 +02:00
Documentation: use subdir-y to avoid unnecessary built-in.o files
2014-09-26 11:02:55 +02:00
Documentation: Add list of laptop models supported by the Compal driver
2014-06-10 19:11:06 -04:00
Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm
2014-12-12 15:26:48 -08:00
cxl: Add documentation for userspace APIs
2014-10-08 20:16:19 +11:00
Documentation: Restrict TSC test code to x86
2014-10-28 08:46:27 -04:00
ptp: restore the makefile for building the test program.
2014-10-24 16:07:10 -04:00
rapidio/tsi721_dma: rework scatter-gather list handling
2014-08-08 15:57:24 -07:00
Merge branches 'torture.2014.11.03a', 'cpu.2014.11.03a', 'doc.2014.11.13a', 'fixes.2014.11.13a', 'signal.2014.10.29a' and 'rt.2014.10.29a' into HEAD
2014-11-13 10:39:04 -08:00
s390/docs: Remove sections that are not related to s390
2014-11-18 18:22:59 +01:00
Documentation/scheduler/sched-deadline.txt: Add minimal main() appendix
2014-09-16 10:23:45 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2014-12-12 10:08:06 -08:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity into next
2014-11-19 21:36:07 +11:00
serial: Fix locking for uart driver set_termios() method
2014-11-05 18:53:54 -08:00
ALSA: hda - Add "eapd" model string for AD1986A codec
2014-12-10 14:00:13 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/doc
2014-10-07 21:14:57 -04:00
net-timestamp: no-payload only sysctl
2015-02-02 18:46:51 -08:00
Documentation/target: Update fabric_ops to latest code
2015-01-06 13:46:49 -08:00
Documentation: thermal: document of_cpufreq_cooling_register()
2015-01-06 14:39:17 -04:00
Documentation: update .gitignore files
2014-09-26 11:02:59 +02:00
Char/Misc driver patches for 3.19-rc1
2014-12-14 16:43:47 -08:00
USB patches for 3.19-rc1
2014-12-14 14:57:16 -08:00
vdso: don't require 64-bit math in standalone test
2014-10-25 10:53:44 -04:00
[media] vivid.txt: document new controls
2014-12-16 23:21:37 -02:00
Second round of changes for KVM for arm/arm64 for v3.19; fixes reboot
2014-12-15 13:06:40 +01:00
Merge branch 'akpm' (second patch-bomb from Andrew)
2014-12-13 13:00:36 -08:00
w1: new w1_ds2406 driver
2014-06-19 17:45:14 -07:00
Documentation: use subdir-y to avoid unnecessary built-in.o files
2014-09-26 11:02:55 +02:00
Merge branch 'x86-mpx-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-12-19 13:22:42 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2014-08-06 21:03:53 -07:00
locking/Documentation: Move locking related docs into Documentation/locking/
2014-08-13 10:32:03 +02:00
Documentation: change "&" to "and" in Documentation/applying-patches.txt
2014-09-26 11:10:11 +02:00
documentation: Add atomic_long_t to atomic_ops.txt
2014-11-13 10:34:54 -08:00
binfmt_misc: touch up documentation a bit
2014-10-14 02:18:16 +02:00
Update old iproute2 and Xen Remus links
2014-12-09 13:38:13 -05:00
clk: Change clk_ops->determine_rate to return a clk_hw as the best parent
2014-12-03 16:21:37 -08:00
CodingStyle: add some more error handling guidelines
2014-12-02 08:55:32 -05:00
firewire: revert to 4 GB RDMA, fix protocols using Memory Space
2014-05-29 15:50:30 +02:00
Documentation: correct parameter error for dma_mapping_error
2014-09-26 11:22:29 +02:00
DMA-API: Capitalize "CPU" consistently
2014-05-26 17:28:27 -06:00
doc: spelling error changes
2014-05-05 15:32:05 +02:00
Documentation/dma-buf-sharing.txt: update API descriptions
2014-08-28 11:57:24 +05:30
DMA-API: Clarify physical/bus address distinction
2014-05-20 16:54:21 -06:00
doc: spelling error changes
2014-05-05 15:32:05 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial into next
2014-06-04 08:50:34 -07:00
Documentation/email-clients.txt: add info about Claws Mail
2014-12-02 11:55:29 -05:00
Documentation: remove outdated references to the linux-next wiki
2014-10-28 09:06:11 -04:00
Documentation: HSI: Add some general description for the HSI subsystem
2014-05-04 09:49:46 +02:00
ipmi: Add SMBus interface driver (SSIF)
2014-12-11 15:04:11 -06:00
irqdomain: Introduce new interfaces to support hierarchy irqdomains
2014-11-23 13:01:45 +01:00
Documentation: update java sample wrapper for java 7
2014-05-25 12:39:00 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-01-27 16:59:56 -08:00
Documentation: Add CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF case
2014-10-24 13:59:03 -04:00
kobject: grammar fix
2014-12-08 09:07:11 -05:00
Documentation/kprobes: add s390 to list of supported architectures
2014-09-09 08:53:27 +02:00
kselftest: Move the docs to the Documentation dir
2014-11-24 10:49:54 -07:00
percpu: update local_ops.txt to reflect this_cpu operations
2014-12-13 12:42:53 -08:00
lockup-watchdogs: Fix a typo
2014-08-26 09:35:52 +02:00
Documentation: lzo: document part of the encoding
2014-09-28 11:08:00 +02:00
Documentation: Fix a typo in mailbox.txt
2014-11-03 11:54:50 -05:00
Documentation: add makefiles for more targets
2014-09-26 11:02:56 +02:00
arch: Add lightweight memory barriers dma_rmb() and dma_wmb()
2014-12-11 21:15:06 -05:00
memory-hotplug: add sysfs valid_zones attribute
2014-10-09 22:25:52 -04:00
panic: add TAINT_SOFTLOCKUP
2014-08-08 15:57:24 -07:00
phy: improved lookup method
2014-11-21 19:48:50 +05:30
pinctrl: clean up after enable refactoring
2014-09-04 10:05:07 +02:00
lib/vsprintf: add %*pE[achnops] format specifier
2014-10-14 02:18:26 +02:00
pwm: modify PWM_LOOKUP to initialize all struct pwm_lookup members
2014-05-21 11:19:36 +02:00
pstore-ram: Allow optional mapping with pgprot_noncached
2014-12-11 13:38:31 -08:00
doc: spelling error changes
2014-05-05 15:32:05 +02:00
rfkill: document rfkill module parameters
2015-01-09 23:22:12 +01:00
doc: spelling error changes
2014-05-05 15:32:05 +02:00
stable_kernel_rules: Add pointer to netdev-FAQ for network patches
2014-07-09 15:54:27 -07:00
doc: SubmittingPatches: remove dead link, kerneltrap.org no longer works
2014-06-19 15:15:27 +02:00
Documentation/SubmittingPatches: Reported-by tags and permission
2014-10-29 08:56:46 -04:00
Documentation/sysfs-rules.txt: Add device attribute error code documentation
2014-09-19 14:44:51 -07:00
Docs: this_cpu_ops: remove redundant add forms
2014-09-26 11:03:00 +02:00
drivers/vfio: EEH support for VFIO PCI device
2014-08-05 15:28:48 +10:00
xillybus: Move out of staging
2014-09-23 23:44:16 -07:00
032ee42369
