Re: [PATCH net-next] tcp: provide SYN headers for passive
connections
[Posted May 20, 2015 by jake]
| From: |
| Eric Dumazet <eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w-AT-public.gmane.org> |
| To: |
| John Heffner <johnwheffner-Re5JQEeQqe8AvxtiuMwx3w-AT-public.gmane.org> |
| Subject: |
| Re: [PATCH net-next] tcp: provide SYN headers for passive connections |
| Date: |
| Mon, 04 May 2015 08:12:10 -0700 |
| Message-ID: |
| <1430752330.3711.180.camel@edumazet-glaptop2.roam.corp.google.com> |
| Cc: |
| Eric B Munson <emunson-JqFfY2XvxFXQT0dZR+AlfA-AT-public.gmane.org>, Tom Herbert <tom-BjP2VixgY4xUbtYUoyoikg-AT-public.gmane.org>, "David S. Miller" <davem-fT/PcQaiUtIeIZ0/mPfg9Q-AT-public.gmane.org>, linux-api-u79uwXL29TY76Z2rM5mHXA-AT-public.gmane.org, netdev <netdev-u79uwXL29TY76Z2rM5mHXA-AT-public.gmane.org> |
| Archive‑link: | |
Article |
On Mon, 2015-05-04 at 10:41 -0400, John Heffner wrote:
> Nice idea, seems handy. But a couple (somewhat related) questions:
>
> * Other than convenience, are there reasons not use an existing, more
> general-purpose and portable mechanism like pcap? (Permissions, I
> guess?)
Very hard to synchronize when say you have 32 listeners sharing a single
port (SO_REUSEPORT), and receive one million SYN per second (when my TCP
listener scaling work is finished).
libpcap here would be a serious bottleneck, even with a clever FANIN
support on the af_packet sockets, considering use of multiqueue NIC.
> * Are there conditions where, for security purposes, you don't want an
> application to have access to the raw SYNs?
Not that we are aware of : We restrict the access to IP + TCP headers,
for the passive part. All information that is available there was
provided by the remote peer on a 'open way' anyway.
Thanks.
