Date: Thu, 11 Jul 2013 10:36:22 +0200 From: Andre Oppermann <andre@freebsd.org> To: Fabian Keil <freebsd-listen@fabiankeil.de> Cc: freebsd-net@freebsd.org, freebsd-current@freebsd.org Subject: Re: Improved SYN Cookies: Looking for testers Message-ID: <51DE6E86.6080707@freebsd.org> In-Reply-To: <20130710151821.5a8cf38a@fabiankeil.de> References: <51DA68B8.6070201@freebsd.org> <20130710151821.5a8cf38a@fabiankeil.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On 10.07.2013 15:18, Fabian Keil wrote: > Andre Oppermann <andre@freebsd.org> wrote: > >> We have a SYN cookie implementation for quite some time now but it >> has some limitations with current realities for window scaling and >> SACK encoding the in the few available bits. >> >> This patch updates and improves SYN cookies mainly by: >> >> a) encoding of MSS, WSCALE (window scaling) and SACK into the ISN >> (initial sequence number) without the use of timestamp bits. >> >> b) switching to the very fast and cryptographically strong SipHash-2-4 >> hash MAC algorithm to protect the SYN cookie against forgery. >> >> The patch had been reviewed by dwmalone (cookies) and cperciva (siphash). >> >> Please find it here for testing: >> >> http://people.freebsd.org/~andre/syncookie-20130708.diff > > I've been using the patch for a couple of days and didn't notice any > issues so far. Privoxy's regression tests continue to work as expected > as well. Thanks for testing and reporting back. Could you test with net.inet.tcp.log_debug and net.inet.tcp.syncookies_only=1 as well to bypass the syn cache entirely? It will give a bit of debug log output which is it telling you mostly about rounding to the next nearest index value. You can send the output privately to me to spot unexpected outliers, if any. > BTW, I think kern/173309 could be closed. OK. -- Andre
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?51DE6E86.6080707>