• F
    tcp: syncookies: reduce cookie lifetime to 128 seconds · 8c27bd75
    Florian Westphal 提交于
    We currently accept cookies that were created less than 4 minutes ago
    (ie, cookies with counter delta 0-3).  Combined with the 8 mss table
    values, this yields 32 possible values (out of 2**32) that will be valid.
    
    Reducing the lifetime to < 2 minutes halves the guessing chance while
    still providing a large enough period.
    
    While at it, get rid of jiffies value -- they overflow too quickly on
    32 bit platforms.
    
    getnstimeofday is used to create a counter that increments every 64s.
    perf shows getnstimeofday cost is negible compared to sha_transform;
    normal tcp initial sequence number generation uses getnstimeofday, too.
    Reported-by: NJakob Lell <jakob@jakoblell.com>
    Signed-off-by: NFlorian Westphal <fw@strlen.de>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    8c27bd75
tcp.h 47.9 KB