lkml.org 
[lkml]   [2015]   [May]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH] Allow TCP connections to cache SYN packet for userspace inspection
    From
    On Fri, May 1, 2015 at 11:42 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
    > On Fri, 2015-05-01 at 13:43 -0400, Eric B Munson wrote:
    >> In order to enable policy decisions in userspace, the data contained in
    >> the SYN packet would be useful for tracking or identifying connections.
    >> Only parts of this data are available to userspace after the hand shake
    >> is completed. This patch exposes a new setsockopt() option that will,
    >> when used with a listening socket, ask the kernel to cache the skb
    >> holding the SYN packet for retrieval later. The SYN skbs will not be
    >> saved while the kernel is in syn cookie mode.
    >>
    >> The same option will ask the kernel for the packet headers when used
    >> with getsockopt() with the socket returned from accept(). The cached
    >> packet will only be available for the first getsockopt() call, the skb
    >> is consumed after the requested data is copied to userspace. Subsequent
    >> calls will return -ENOENT. Because of this behavior, getsockopt() will
    >> return -E2BIG if the caller supplied a buffer that is too small to hold
    >> the skb header.
    >>
    >> Signed-off-by: Eric B Munson <emunson@akamai.com>
    >> Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
    >> Cc: James Morris <jmorris@namei.org>
    >> Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
    >> Cc: Patrick McHardy <kaber@trash.net>
    >> Cc: netdev@vger.kernel.org
    >> Cc: linux-api@vger.kernel.org
    >> Cc: linux-kernel@vger.kernel.org
    >> ---
    >
    > We have a similar patch here at Google, but we do not hold one skb and
    > dst per saved syn. That can be ~4KB for some drivers.
    >
    > Only a kmalloc() with the needed part (headers), usually less than 128
    > bytes. We store the length in first byte of this allocation.
    >
    > This has a huge difference if you want to have ~4 million request socks.
    >
    +1 on kmalloc solution. I posted a similar patch a couple of years ago
    https://patchwork.ozlabs.org/patch/146034/. There was pushback on
    memory usage and this having to narrow of a use case.

    Tom

    >
    >
    >
    > --
    > To unsubscribe from this list: send the line "unsubscribe netdev" in
    > the body of a message to majordomo@vger.kernel.org
    > More majordomo info at http://vger.kernel.org/majordomo-info.html


    \
     
     \ /
      Last update: 2015-05-01 22:21    [W:2.559 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site