Diff 84621

View Options

share/man/man9/Makefile

Show All 28 Lines

.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

.\" SUCH DAMAGE.

.\"

.\" From: @(#)tcp.4 8.1 (Berkeley) 6/5/93

.\" $FreeBSD$

.\"

.Dd October 7, 2022

.Dd October 13, 2022

.Dt TCP 4

.Os

.Sh NAME

.Nm tcp

.Nd Internet Transmission Control Protocol

.Sh SYNOPSIS

.In sys/types.h

.In sys/socket.h

▲ Show 20 Lines • Show All 459 Lines • ▼ Show 20 Lines

Outgoing connections will request ECN.

.It 2

Allow incoming connections to request ECN.

Outgoing connections will not request ECN.

(default)

.It 3

Negotiate on incoming connection for Accurate ECN, ECN, or no ECN.

Outgoing connections will request Accurate ECN and fall back to

ECN depending on the capabilities of the server.

ECN depending on the capabilities of the remote host.

pauamma_gundo.comUnsubmitted

Done

Outgoing connections will request Accurate ECN and fall back to

- ECN depending on the capabilities of the server.

+ ECN depending on the capabilities of the remote host.

.It 4

pauamma_gundo.com:

.It 4

Negotiate on incoming connection for Accurate ECN, ECN, or no ECN.

Outgoing connections will not request ECN.

.El

.It Va ecn.generalized

Enable sending all segments as ECN capable transport,

including SYN, SYN/ACK, and retransmissions.

This may only be enabled when ECN support itself is also active.

Disabling ECN support will disable this feature automatically.

Settings:

.Bl -tag -compact

.It 0

Regular RFC3168 operation.

Send only new data segments as ECN capable transport.

(default)

.It 1

Support generalized ECN (ECN++), and send all segments of an ECN-enabled

session as ECN capable transport.

Also control packets to non-established and non-listening ports are

identically marked, if outgoing sessions would request ECN.

.El

.It Va ecn.maxretries

Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a

specific connection.

This is needed to help with connection establishment

when a broken firewall is in the network path.

.It Va fast_finwait2_recycle

Recycle

.Tn TCP

.Dv FIN_WAIT_2

pauamma_gundo.comUnsubmitted

Done

including SYN, SYN/ACK, and retransmissions.

- This may only be enabled, when ECN support itself is also active.

+ This may only be enabled when ECN support itself is also active.

Disabling ECN support will disable this feature automatically.

pauamma_gundo.com:

connections faster when the socket is marked as

.Dv SBS_CANTRCVMORE

(no user process has the socket open, data received on

the socket cannot be read).

The timeout used here is

.Va finwait2_timeout .

.It Va fastopen.acceptany

pauamma_gundo.comUnsubmitted

Done

Regular RFC3168 operation.

- Send only new data segements as ECN capable transport.

- (default)

+ Send only new data segments as ECN capable transport (default).

.It 1

Typo and move full stop to a more natural place.

pauamma_gundo.com: Typo and move full stop to a more natural place.

When non-zero, all client-supplied TFO cookies will be considered to be valid.

The default is 0.

.It Va fastopen.autokey

When this and

.Va net.inet.tcp.fastopen.server_enable

bcrUnsubmitted

Done

s/identially/identically/

bcr: s/identially/identically/

pauamma_gundo.comUnsubmitted

Done

Can you explain what you mean by that? I'm arguably not the indended audience, but if I don't understand it, there's a chance some of the intended audience and or some interested readers won't either.

pauamma_gundo.com: Can you explain what you mean by that? I'm arguably not the indended audience, but if I don't…

rscheffAuthorUnsubmitted

Done

When a host receives a TCP packet to a port which is not listening, or no connection exists, or the header information is in some other way not acceptable, the host may respond with a RST (reset) packet. Some of these RST packets are sent from "regular" TCP processing (e.g. outside the sequence window) and others from non-open ports. Making these distinctable by carrying different markings - depending which code path was sending them - would give clues as to what ports/services may be reachable, and give rise to more targetted attacks.
As part if this change, when introducing this new capability (modified TCP header markings for sessions), the irregular codepath is addressed too, such that a 3rd party can not deduct which of the two different paths was sending out the RST, reducing an information side-channel.

rscheff: When a host receives a TCP packet to a port which is not listening, or no connection exists, or…

pauamma_gundo.comUnsubmitted

Done

Gotcha, thanks. Would "This value also uses ECN for RST replies to probes of non-open ports." mean the same? It looks clearer to me.

pauamma_gundo.com: Gotcha, thanks. Would "This value also uses ECN for RST replies to probes of non-open ports."…

are non-zero, a new key will be automatically generated after this specified

seconds.

The default is 120.

.It Va fastopen.ccache_bucket_limit

The maximum number of entries in a client cookie cache bucket.

The default value can be tuned with the

.Dv TCP_FASTOPEN_CCACHE_BUCKET_LIMIT_DEFAULT

kernel option or by setting

▲ Show 20 Lines • Show All 201 Lines • ▼ Show 20 Lines

The value of 1 limits the logging to

.Tn SYN

(connection establishment) packets only.

A value of 2 results in any

.Tn TCP

packets to closed ports being logged.

Any value not listed above disables the logging

(default is 0, i.e., the logging is disabled).

.It Va maxtcptw

When a TCP connection enters the

.Dv TIME_WAIT

state, its associated socket structure is freed, since it is of

negligible size and use, and a new structure is allocated to contain a

minimal amount of information necessary for sustaining a connection in

this state, called the compressed TCP

.Dv TIME_WAIT

state.

Since this structure is smaller than a socket structure, it can save

a significant amount of system memory.

The

.Va net.inet.tcp.maxtcptw

MIB variable controls the maximum number of these structures allocated.

By default, it is initialized to

.Va kern.ipc.maxsockets

/ 5.

pauamma_gundo.comUnsubmitted

Done

Was removing this intended as part of this review?

pauamma_gundo.com: Was removing this intended as part of this review?

rscheffAuthorUnsubmitted

Done

I'm confused, there is no change here on reviews.freebsd.org; it may be that this diff was uploaded just prior to a flurry of tcp related (including man page) changes, which I have not yet rebased the patch to...

rscheff: I'm confused, there is no change here on reviews.freebsd.org; it may be that this diff was…

.It Va minmss

Minimum TCP Maximum Segment Size; used to prevent a denial of service attack

from an unreasonably low MSS.

.It Va msl

The Maximum Segment Lifetime, in milliseconds, for a packet.

.It Va mssdflt

The default value used for the TCP Maximum Segment Size

.Pq Dq MSS

▲ Show 20 Lines • Show All 337 Lines • Show Last 20 Lines

View Options

share/man/man9/zero_region.9

Show All 28 Lines

.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

.\" SUCH DAMAGE.

.\"

.\" From: @(#)tcp.4 8.1 (Berkeley) 6/5/93

.\" $FreeBSD$

.\"

.Dd October 7, 2022

.Dd October 13, 2022

.Dt TCP 4

.Os

.Sh NAME

.Nm tcp

.Nd Internet Transmission Control Protocol

.Sh SYNOPSIS

.In sys/types.h

.In sys/socket.h

▲ Show 20 Lines • Show All 459 Lines • ▼ Show 20 Lines

Outgoing connections will request ECN.

.It 2

Allow incoming connections to request ECN.

Outgoing connections will not request ECN.

(default)

.It 3

Negotiate on incoming connection for Accurate ECN, ECN, or no ECN.

Outgoing connections will request Accurate ECN and fall back to

ECN depending on the capabilities of the server.

ECN depending on the capabilities of the remote host.

pauamma_gundo.comUnsubmitted

Done

Outgoing connections will request Accurate ECN and fall back to

- ECN depending on the capabilities of the server.

+ ECN depending on the capabilities of the remote host.

.It 4

pauamma_gundo.com:

.It 4

Negotiate on incoming connection for Accurate ECN, ECN, or no ECN.

Outgoing connections will not request ECN.

.El

.It Va ecn.generalized

Enable sending all segments as ECN capable transport,

including SYN, SYN/ACK, and retransmissions.

This may only be enabled when ECN support itself is also active.

Disabling ECN support will disable this feature automatically.

Settings:

.Bl -tag -compact

.It 0

Regular RFC3168 operation.

Send only new data segments as ECN capable transport.

(default)

.It 1

Support generalized ECN (ECN++), and send all segments of an ECN-enabled

session as ECN capable transport.

Also control packets to non-established and non-listening ports are

identically marked, if outgoing sessions would request ECN.

.El

.It Va ecn.maxretries

Number of retries (SYN or SYN/ACK retransmits) before disabling ECN on a

specific connection.

This is needed to help with connection establishment

when a broken firewall is in the network path.

.It Va fast_finwait2_recycle

Recycle

.Tn TCP

.Dv FIN_WAIT_2

pauamma_gundo.comUnsubmitted

Done

including SYN, SYN/ACK, and retransmissions.

- This may only be enabled, when ECN support itself is also active.

+ This may only be enabled when ECN support itself is also active.

Disabling ECN support will disable this feature automatically.

pauamma_gundo.com:

connections faster when the socket is marked as

.Dv SBS_CANTRCVMORE

(no user process has the socket open, data received on

the socket cannot be read).

The timeout used here is

.Va finwait2_timeout .

.It Va fastopen.acceptany

pauamma_gundo.comUnsubmitted

Done

Regular RFC3168 operation.

- Send only new data segements as ECN capable transport.

- (default)

+ Send only new data segments as ECN capable transport (default).

.It 1

Typo and move full stop to a more natural place.

pauamma_gundo.com: Typo and move full stop to a more natural place.

When non-zero, all client-supplied TFO cookies will be considered to be valid.

The default is 0.

.It Va fastopen.autokey

When this and

.Va net.inet.tcp.fastopen.server_enable

bcrUnsubmitted

Done

s/identially/identically/

bcr: s/identially/identically/

pauamma_gundo.comUnsubmitted

Done

pauamma_gundo.com: Can you explain what you mean by that? I'm arguably not the indended audience, but if I don't…

rscheffAuthorUnsubmitted

Done

rscheff: When a host receives a TCP packet to a port which is not listening, or no connection exists, or…

pauamma_gundo.comUnsubmitted

Done

Gotcha, thanks. Would "This value also uses ECN for RST replies to probes of non-open ports." mean the same? It looks clearer to me.

pauamma_gundo.com: Gotcha, thanks. Would "This value also uses ECN for RST replies to probes of non-open ports."…

are non-zero, a new key will be automatically generated after this specified

seconds.

The default is 120.

.It Va fastopen.ccache_bucket_limit

The maximum number of entries in a client cookie cache bucket.

The default value can be tuned with the

.Dv TCP_FASTOPEN_CCACHE_BUCKET_LIMIT_DEFAULT

kernel option or by setting

▲ Show 20 Lines • Show All 201 Lines • ▼ Show 20 Lines

The value of 1 limits the logging to

.Tn SYN

(connection establishment) packets only.

A value of 2 results in any

.Tn TCP

packets to closed ports being logged.

Any value not listed above disables the logging

(default is 0, i.e., the logging is disabled).

.It Va maxtcptw

When a TCP connection enters the

.Dv TIME_WAIT

state, its associated socket structure is freed, since it is of

negligible size and use, and a new structure is allocated to contain a

minimal amount of information necessary for sustaining a connection in

this state, called the compressed TCP

.Dv TIME_WAIT

state.

Since this structure is smaller than a socket structure, it can save

a significant amount of system memory.

The

.Va net.inet.tcp.maxtcptw

MIB variable controls the maximum number of these structures allocated.

By default, it is initialized to

.Va kern.ipc.maxsockets

/ 5.

pauamma_gundo.comUnsubmitted

Done

Was removing this intended as part of this review?

pauamma_gundo.com: Was removing this intended as part of this review?

rscheffAuthorUnsubmitted

Done

rscheff: I'm confused, there is no change here on reviews.freebsd.org; it may be that this diff was…

.It Va minmss

Minimum TCP Maximum Segment Size; used to prevent a denial of service attack

from an unreasonably low MSS.

.It Va msl

The Maximum Segment Lifetime, in milliseconds, for a packet.

.It Va mssdflt

The default value used for the TCP Maximum Segment Size

.Pq Dq MSS

▲ Show 20 Lines • Show All 337 Lines • Show Last 20 Lines

Add zero_region.9 manual page
ClosedPublic
Actions

Details

Diff Detail

Event Timeline

Revision Contents
Changeset List

Diff 84621

share/man/man9/Makefile

share/man/man9/zero_region.9

Add zero_region.9 manual pageClosedPublicActions

Details

Diff Detail

Event Timeline

Revision ContentsChangeset List

Diff 84621

share/man/man9/Makefile

share/man/man9/zero_region.9

Add zero_region.9 manual page
ClosedPublic
Actions

Revision Contents
Changeset List