Page MenuHomeFreeBSD

avoid unneeded call to arc4random() in syncache_add()
ClosedPublic

Authored by gallatin on Sep 10 2019, 7:47 PM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 26 2024, 6:29 PM
Unknown Object (File)
Dec 28 2023, 2:56 PM
Unknown Object (File)
Dec 13 2023, 8:25 AM
Unknown Object (File)
Nov 3 2023, 5:44 AM
Unknown Object (File)
Sep 19 2023, 10:33 AM
Unknown Object (File)
Sep 7 2023, 10:36 PM
Unknown Object (File)
Sep 7 2023, 10:33 PM
Unknown Object (File)
Sep 7 2023, 10:30 PM
Subscribers

Details

Summary

We currently call arc4random() unconditionally to initialize sc_iss, but then when syncookies are enabled, we overwrite it with the return value from from syncookie_generate(). It would seem to make more sense to only call arc4random() when syncookies are not enabled.

Note that on a system under a syn flood attack, arc4random() becomes quite expensive, and the chacha_poly crypto that it calls is one of the more expensive things happening on the system. Removing this unneeded arc4random() call reduces CPU from about 40% to about 35% in my test scenario (Broadwell Xeon, 6Mpps syn flood attack).

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable