HomeFreeBSD

tcp_syncache: add net.inet.tcp.syncache.see_other sysctl

Description

tcp_syncache: add net.inet.tcp.syncache.see_other sysctl

A security feature from c06f087ccb12 appeared to be a huge bottleneck
under SYN flood. To mitigate that add a sysctl that would make
syncache(4) globally visible, ignoring UID/GID, jail(2) and mac(4)
checks. When turned on, we won't need to call crhold() on the listening
socket credential for every incoming SYN packet.

Reviewed by: bz

Details

Provenance
glebiusAuthored on Mar 19 2021, 7:22 AM
Parents
R10:34256484aff2: Revert "nfsd: cut the Linux NFSv4.1/4.2 some slack w.r.t. RFC5661"
Branches
Unknown
Tags
Unknown