• Eric Dumazet's avatar
    tcp: do not create inetpeer on SYNACK message · 7433819a
    Eric Dumazet authored
    Another problem on SYNFLOOD/DDOS attack is the inetpeer cache getting
    larger and larger, using lots of memory and cpu time.
    
    tcp_v4_send_synack()
    ->inet_csk_route_req()
     ->ip_route_output_flow()
      ->rt_set_nexthop()
       ->rt_init_metrics()
        ->inet_getpeer( create = true)
    
    This is a side effect of commit a4daad6b (net: Pre-COW metrics for
    TCP) added in 2.6.39
    
    Possible solution :
    
    Instruct inet_csk_route_req() to remove FLOWI_FLAG_PRECOW_METRICS
    
    Before patch :
    
    # grep peer /proc/slabinfo
    inet_peer_cache   4175430 4175430    192   42    2 : tunables    0    0    0 : slabdata  99415  99415      0
    
    Samples: 41K of event 'cycles', Event count (approx.): 30716565122
    +  20,24%      ksoftirqd/0  [kernel.kallsyms]           [k] inet_getpeer
    +   8,19%      ksoftirqd/0  [kernel.kallsyms]           [k] peer_avl_rebalance.isra.1
    +   4,81%      ksoftirqd/0  [kernel.kallsyms]           [k] sha_transform
    +   3,64%      ksoftirqd/0  [kernel.kallsyms]           [k] fib_table_lookup
    +   2,36%      ksoftirqd/0  [ixgbe]                     [k] ixgbe_poll
    +   2,16%      ksoftirqd/0  [kernel.kallsyms]           [k] __ip_route_output_key
    +   2,11%      ksoftirqd/0  [kernel.kallsyms]           [k] kernel_map_pages
    +   2,11%      ksoftirqd/0  [kernel.kallsyms]           [k] ip_route_input_common
    +   2,01%      ksoftirqd/0  [kernel.kallsyms]           [k] __inet_lookup_established
    +   1,83%      ksoftirqd/0  [kernel.kallsyms]           [k] md5_transform
    +   1,75%      ksoftirqd/0  [kernel.kallsyms]           [k] check_leaf.isra.9
    +   1,49%      ksoftirqd/0  [kernel.kallsyms]           [k] ipt_do_table
    +   1,46%      ksoftirqd/0  [kernel.kallsyms]           [k] hrtimer_interrupt
    +   1,45%      ksoftirqd/0  [kernel.kallsyms]           [k] kmem_cache_alloc
    +   1,29%      ksoftirqd/0  [kernel.kallsyms]           [k] inet_csk_search_req
    +   1,29%      ksoftirqd/0  [kernel.kallsyms]           [k] __netif_receive_skb
    +   1,16%      ksoftirqd/0  [kernel.kallsyms]           [k] copy_user_generic_string
    +   1,15%      ksoftirqd/0  [kernel.kallsyms]           [k] kmem_cache_free
    +   1,02%      ksoftirqd/0  [kernel.kallsyms]           [k] tcp_make_synack
    +   0,93%      ksoftirqd/0  [kernel.kallsyms]           [k] _raw_spin_lock_bh
    +   0,87%      ksoftirqd/0  [kernel.kallsyms]           [k] __call_rcu
    +   0,84%      ksoftirqd/0  [kernel.kallsyms]           [k] rt_garbage_collect
    +   0,84%      ksoftirqd/0  [kernel.kallsyms]           [k] fib_rules_lookup
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: Hans Schillstrom <hans.schillstrom@ericsson.com>
    Cc: Jesper Dangaard Brouer <brouer@redhat.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Tom Herbert <therbert@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    7433819a
inet_connection_sock.c 22.2 KB