3 ms·
This can also be used to implement connection acceleration with no kernel-side hackery involved, by having userspace maintain a pool of half-open connections by
by dmw_ng 4y ago
This can also be used to implement connection acceleration with no kernel-side hackery involved, by having userspace maintain a pool of half-open connections by spamming SYNs at a target, recording ACKs, then constructing a regular socket via TCP_REPAIR when a connection is actually required. That allows omitting one roundtrip from a typical TCP connection setup, which may be substantial in a variety of scenarios.
The technique sounds messy but actually it involves not much work when the target is Linux, a single half-open SYN is good for 63 seconds with the default sysctl settings, which seem to be used with almost every Internet service you might want to reach (including e.g. Google)
I was playing with this during an interview last year and intended to write it up, but never got around to it. The technique seems to work as intended, I made a little prototype reverse proxy for it in Python using a temporary listening socket with a drop-all SO_ATTACH_FILTER to allocate a port number and prevent Linux on the initiator side from responding with a RST to ACKs for a half-open connection it knows nothing about
- hnov 4y agoFor what protocol would this be advantageous over plain connection pooling?
- dmw_ng 4y agoThe original problem was for load balancing, where the protocol is often not known, and backends might be reached over a WAN. There are some neat advantages possible from this method, such as the target application not being woken up early from accept() (etc) by preconnection, and the initiator being able to detect the health of a backend before choosing it as the target of a forwarded connection, but mostly I just thought it was an interesting abuse of an obscure kernel feature.
- ilyt 4y agoSounds like nice way to DoS target at worst, trigger some IDS/IPS at best ?
- ale42 4y agoIn a reverse proxy scenario, you would trigger your own IDS, so you can probably configure it appropriately...
- dmw_ng 4y agoIdeally it's only necessary transmit about 1 frame per minute for each half-open connection, but you're right, I found one site, India's rail operator IRCTC that still blocked this traffic very quickly.