Skip to content

Commit

Permalink
tcp: configurable source port perturb table size
Browse files Browse the repository at this point in the history
On embedded systems with little memory and no relevant
security concerns, it is beneficial to reduce the size
of the table.

Reducing the size from 2^16 to 2^8 saves 255 KiB
of kernel RAM.

Makes the table size configurable as an expert option.

The size was previously increased from 2^8 to 2^16
in commit 4c2c8f0 ("tcp: increase source port perturb table to
2^16").

Signed-off-by: Gleb Mazovetskiy <glex.spb@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Gleb Mazovetskiy authored and David S. Miller committed Nov 16, 2022
1 parent b68777d commit aeac4ec
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 5 deletions.
10 changes: 10 additions & 0 deletions net/ipv4/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -402,6 +402,16 @@ config INET_IPCOMP

If unsure, say Y.

config INET_TABLE_PERTURB_ORDER
int "INET: Source port perturbation table size (as power of 2)" if EXPERT
default 16
help
Source port perturbation table size (as power of 2) for
RFC 6056 3.3.4. Algorithm 4: Double-Hash Port Selection Algorithm.

The default is almost always what you want.
Only change this if you know what you are doing.

config INET_XFRM_TUNNEL
tristate
select INET_TUNNEL
Expand Down
10 changes: 5 additions & 5 deletions net/ipv4/inet_hashtables.c
Original file line number Diff line number Diff line change
Expand Up @@ -906,13 +906,13 @@ EXPORT_SYMBOL_GPL(inet_bhash2_update_saddr);
* Note that we use 32bit integers (vs RFC 'short integers')
* because 2^16 is not a multiple of num_ephemeral and this
* property might be used by clever attacker.
*
* RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though
* attacks were since demonstrated, thus we use 65536 instead to really
* give more isolation and privacy, at the expense of 256kB of kernel
* memory.
* attacks were since demonstrated, thus we use 65536 by default instead
* to really give more isolation and privacy, at the expense of 256kB
* of kernel memory.
*/
#define INET_TABLE_PERTURB_SHIFT 16
#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT)
#define INET_TABLE_PERTURB_SIZE (1 << CONFIG_INET_TABLE_PERTURB_ORDER)
static u32 *table_perturb;

int __inet_hash_connect(struct inet_timewait_death_row *death_row,
Expand Down

0 comments on commit aeac4ec

Please sign in to comment.